is

Risks Digest 34.43

Posted by RISKS List Owner on Aug 29

RISKS-LIST: Risks-Forum Digest Thursday 29 Aug 2024 Volume 34 : Issue 43

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.43>
The current issue can also be found at
<...




is

Risks Digest 34.44

Posted by RISKS List Owner on Sep 08

RISKS-LIST: Risks-Forum Digest Sunday 8 Sep 2024 Volume 34 : Issue 44

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.44>
The current issue can also be found at
<...




is

Risks Digest 34.45

Posted by RISKS List Owner on Sep 14

RISKS-LIST: Risks-Forum Digest Saturday 14 Sep 2024 Volume 34 : Issue 45

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.45>
The current issue can also be found at
<...




is

Risks Digest 34.46

Posted by RISKS List Owner on Oct 01

RISKS-LIST: Risks-Forum Digest Tuesday 1 Oct 2024 Volume 34 : Issue 46

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.46>
The current issue can also be found at
<...




is

Risks Digest 34.47

Posted by RISKS List Owner on Oct 17

RISKS-LIST: Risks-Forum Digest Thursday 17 Oct 2024 Volume 34 : Issue 47

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.47>
The current issue can also be found at
<...




is

Risks Digest 34.48

Posted by RISKS List Owner on Nov 08

RISKS-LIST: Risks-Forum Digest Friday 8 Nov 2024 Volume 34 : Issue 48

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.48>
The current issue can also be found at
<...




is

CISA and NSA Release Enduring Security Framework Guidance on Identity and Access Management

Posted by CISA on Mar 21

Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow

You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information
has recently been updated, and is now available.

CISA and NSA Release Enduring Security Framework Guidance on Identity and Access Management [...




is

CISA Releases Eight Industrial Control Systems Advisories

Posted by CISA on Mar 21

Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow

You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information
has recently been updated, and is now available.

CISA Releases Eight Industrial Control Systems Advisories [
https://www.cisa.gov/news-events/alerts/2023/03/21/cisa-releases-eight-industrial-control-systems-advisories ]
03/21/2023 08:00 AM...




is

CISA Releases Six Industrial Control Systems Advisories

Posted by CISA on Mar 23

Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow

You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information
has recently been updated, and is now available.

CISA Releases Six Industrial Control Systems Advisories [
https://www.cisa.gov/news-events/alerts/2023/03/23/cisa-releases-six-industrial-control-systems-advisories ] 03/23/2023
08:00 AM EDT...




is

Persistence and Strategic Effects

Posted by Dave Aitel via Dailydave on Aug 15

Before there were words, calculated as the softmax of a list of possible
tokens, there were just vectors of nano-electrical potential in cells
soaked in a hormonal brew of electrolytes, operating on a clock cycle of
"slow, but fast enough". In this sense, as we now know
<https://www.ncbi.nlm.nih.gov/pmc/articles/PMC10472538/>, we generate words
and we know, in our heads, what we are, in the same way as we generate
limbs, with each...




is

Re: Persistence and Strategic Effects

Posted by the grugq via Dailydave on Aug 16

Cyber is Calvinball.

I gave a talk back in 2015 [1] which I think has held up rather well. My argument was that cyber is evolving in
unpredictable ways as we learn more about the domain. That the current state of the art has huge blind spots we aren’t
even thinking about. The next year was, of course, the 2016 disinformation campaign fed by cyber loot.

I feel that a great deal of cyber war literature is based on knowledge derived from...




is

Episode 0: About

This is the first episode (actually, episode zero) of software engineering radio. The episode does not contain real content, rather, Markus explains what the podcast is all about.




is

Episode 1: Patterns

In this episode Michael and Markus talk about patterns. Starting with some of their "most used" patterns, they go into some detail about the history of patterns. They then discuss the various pattern forms as well as some misconceptions about patterns. Other topics include the domains that are covered by patterns as well as pattern languages.




is

Episode 2: Dependencies

Eberhard and Markus discuss the important topic of associations and dependencies in this show. While OO languages provide direct support for subtyping, most don't provide a first-class construct for other relationships between objects. The discussion elaborates on the problem and looks at various remedies, most importantly, dependency injection.




is

Episode 3: Interview Doug Schmidt

In this episode we talk with Doug Schmidt. Doug is a professor of computer science at Vanderbilt University and a well-respected authority in the fields of middleware, patterns and model-driven development. In this interview we talk about these topics in the context of distributed, realtime embedded (DRE) systems.




is

Episode 4: Scripting Languages

In this Episode, Alexander and Markus talk about scripting languages. Topics include the definition of what a scripting language is, typical usage scenarios, performance issues, programming styles and IDE support. In later Episodes we will talk about more specific topics, such as dynamic typing, reflection, functional programming as well as specific languages such as Ruby.




is

Episode 5: Model-Driven Software Development Pt. 1

In this Episode, Eberhard and Markus provide an introduction to Model-Driven Software Development. Since the discussion turned out to be too long, we separated things into two episodes, thus Episode 6 will be the second part of this discussion. In this first part we disucsss core concepts of MDSD, the relationship to MDA, and hint at a couple of tools.




is

Episode 6: Model-Driven Software Development Pt. 2

After discussing some of the more technical aspects of MDSD in the last episode, we take a look at other important topics in this one. This includes some tips on how to introduce MDSD into projects and how the development process has to be adapted for this to work, as well as a look at the return on investment for MDSD. The relationship of MDSD and Agile software development is also discussed. Finally, we take a look at offshoring in the context of MDSD.




is

Episode 7: Error Handling

This week, Arno and Markus take a look at error handling at the architectural level. They discuss the different kinds of errors, the groups of people who need to know about them and proven high-level approaches. Later episodes will investigate more technical aspects of error handling, such as idioms for using exceptions or a discussion of checked vs. unchecked exceptions.




is

Episode 8: Interview Eric Evans

Eric Evans is the author of the well known Domain-Driven Design book. In his day job he works as a consultant and coach for his own company, Domain Language. In this interview, Eric talks about the essential building blocks of domain-driven design as well as about a set of best practices on how to address complex projects. In a third part, he elaborates on the relationship of domain-driven design and MDSD/MDA.




is

Episode 9: Remoting Pt.1 and Listener Feedback

This Episode as well as the next one take a look at remoting infrastructures such as CORBA, .NET Remoting or Webservices. In this first part we will take a look at why remote communication is necessary in the first place, what remoting middleware can do for you as well as which other middleware technologies exist in addition to OO-RPC systems, such as messaging middleware. Finally, we conclude with a brief overview of what the broker pattern can do for us in the context of remoting middleware.




is

Episode 10: Remoting Pt. 2

This is the second part of the remoting infrastructures discussion started in Episode 9. We take a look at how remoting infrastructures such as CORBA, .NET Remoting or Web Services work internally. This includes the low level details of the transport layer, marshalling, client proxies as well as interceptors and asynchronous communication. At the end, Michael will explain how all this relates to CORBA and Markus will map the concepts to .NET remoting. We don't have additional links in these show notes since all the relevant links had been posted for Episode 9 already.




is

Episode 11: Interview Gregor Kiczales

In this Episode we have the pleasure of talking with Gregor Kiczales. Gregor is one of the fathers of aspect-oriented programming (AOP). Today he is a professor of computer science at the University of British Columbia. Back in his days at Xerox Parc, he and a number of other people worked on the early forms of AOP as well as on some of its forerunners, such as meta object protocols. In this interview, we talk about a number of interesting topics, such as the history of AOP, the relationship of AO to interceptors, the industry acceptance of AOP, early aspects (i.e. using AO in development phased before implementation) as well as adoption strategies for AOP.




is

Episode 12: Concurrency Pt. 1

This is the first part of a series of Concurrency episodes. In this part Alex and Michael motivate and introduce the topic. We explain fundamental terms, such as thread, process, or mutex and dicuss typical challenges, such as deadlocks and race conditions.




is

Episode 13: Ruby in Practice

Ruby has been getting more and more attention by the developer community over the last couple of years. Nevertheless Ruby as language and as a plattform is not too widespread. Most developers don't know people who have actually done commercial Ruby projects. Therefore it is sometimes hard to judge if Ruby is just a hype topic or if Ruby can be used for serious projects today. In this episode Alexander speaks with Thomas Quas about a commercial Ruby project Thomas finished a while ago. Thomas shares his insights and practical experiences with Ruby doing a project under strong time pressure. As Thomas has many years experience doing Java projects we also do some high level comparisons between both platforms.




is

Episode 14: Interview Ted Neward

In this Episode we talk to Ted Neward. Since Ted is active in the .NET and Java universes, we started out by discussing some of the differences between the two platforms. The main discussion, however, focussed on new features in the C# 3.0 language. These include LINQ (language-integrated query). A very interesting discussion about extension methods, lamda expression, typing (dynamic, duck, compiler) and other language "tricks" follows. We also visited the topic of language development on the .NET and Java platforms in general, also looking at topics such as concurrency and the Scala language.




is

Episode 15: The Future of Enterprise Java

A very important area for Java are Enterprise Systems. With the advent of new technologies like Ruby on Rails, Java EE 5 or EJB 3 the landscape for Enterprise Systems appears to be changing a lot at the moment. In this episode Markus talks with Eberhard about what Enterprise Java actually is, why and where it is used. Based on that they discuss what the future might look like and how to make Enterprise Java shine in the future.




is

Episode 16: MDSD Pt. 3, Hands-On

This episode provides a hands-on guided tour through a simple model-driven software project. It is based on an actual code sample (see link below) and takes a look at the typical steps of real-life code generation: prototypical implementation, defining the metamodel, reading a model into a metamodel instance, writing templates and validating the model. The example for the episode uses openArchitectureWare as a generator environment, but the overall approach is tool independent. This episode is the first in a new category "code/technology" that discusses technical concepts based on actual code. Please give feedback whether you find this format useful or not.




is

Episode 17: Feedback and Roadmap

This is a short episode that outlines the upcoming episodes and interviews, as well as reports on some listener feedback.




is

Episode 18: Resource Management

In this episode Michael and our guest Prashant Jain talk about patterns for resource management. Efficient management of resources is critical in the execution of any kind of software. Ranging from embedded software in a mobile device to software in a large enterprise server, it is important that the resources, such as memory, threads, file handles, or network connections, are managed efficiently to allow the systems to function properly and effectively. Michael and Prashant discuss various patterns, such as Lazy Acquisition, Caching, Leasing and Evictor and explain when, why, and how to apply them for effective resource management.




is

Episode 19: Concurrency Pt. 2

In this second part of our concurrency series Michael and Alexander talk about basic patterns for concurrent programming, such as Active and Monitor Object, Scoped Locking and Futures. Further, they discuss some architectural considerations regarding the number of threads and resource usage in general. For more information, see the references for part one as well as the following links




is

Episode 20: Interview Michael Stal

In this Episode, we talk to Michael Stal, a Senior Principal Engineer at Siemens Corporate Technology, POSA 1 and 2 Co-Author and Editor of the german JavaSpetrum magazine. Since Michael's core focus is middlware, much of our discussion centered around that topic. Webservices and SOA, of course, have also been covered. Other topics include Java vs. .NET as well as Patterns.




is

Episode 21: Error Handling Pt. 2

In this Episode, Arno and Michael take a closer look at Exceptions and Error conditions, how to categorize them and how to deal with them. We look at the different levels of guarantee that a piece of code can provide with regard to exceptional condition and finish with a discussion of a number of best practices and their respective trade-offs.




is

Episode 22: Feedback

This is an episode with some more of your feedback. Specifically, the episode also contains a 5 minute section from Geert Bevin where he explains how Continuations are used an implemented in the Rife Framework. This is in response to a discussion about continuations and Rife in Episode 15, Future of Enterprise Java. We also have some feedback from Bill Pugh about flaws in our description about the problems of double-checked locking in Java.




is

Episode 23: Architecture Pt. 1

This is the first of a series of Episodes on Software Architecture. Alex, Michael and Markus talk about rather fundamental topics in this episode, we'll go into much more detail in subsequent episodes in that series. Topics in this episode include:

  • What is architecture, how is it different from design
  • what different kinds of architecture are there in addition to software architecture
  • the role of the architect, do we have one or more?
  • architecture in agile software development
  • tasks of the architect
  • architect vs. the technical project lead
  • architecture and project politics
  • architecture requirements, estimating, team assembling
There aren't too many good references for this general architecture discussion. You might want to take a look at Software Architecture in Practice by Len Bass, or, if you speak German, at the book Software-Architektur by Vogel, Arnold, Chugtai, Ihler, Mehlig, Neumann, Voelter and Zdun.




is

Episode 24: Development Processes Pt.1

In this episode Arno and Alex talk about the basics of software development processes. They discuss why and when software development processes are needed and also why some developers don't like them. They discuss the theories behind different processes and talk about defined vs empiric processes in general. This episode is the first in a row that will later on describe specific processes like eXtreme programming or the unified process.




is

Episode 25: Architecture Pt. 2

In this Episode, Michael and Markus continue the discussion about the fundamentals of software architecture (we're doing it without Alex, because it is really hard to find a suitable time for all of us on the phone :-)). We talk about the various quality attributes (such as performance, scalability, maintainability and many more) and how they relate to each other.




is

Episode 26: Interview Jutta Eckstein

In this Episode, Arno, Bernd and Markus interview Jutta Eckstein. Jutta is a pioneer and expert on using Agile software development, specifically in larger teams. In the interview we talk about the agile manifesto, the role of personal relationships and trust in software projects, differences between agility in the small and in the large, as well as offshoring.




is

Episode 27: Service Oriented Architecture Pt.1

SOA (Service Oriented Architecture) appears to be just another hype - after all we have been building distributed systems for quite a while now. But the real value of SOA is non-technical. In this episode Eberhard and Markus discuss the advantages and disadvantages, what SOA actually is and how it compares to other approaches that have been tried out before.




is

Episode 28: Type Systems

In recent episodes we have discusses statically and dynamically typed languages and domain specific languages - topics that are much talked about in the community at the moment. In this episode we look at the foundation of programming languages : types. We explain what a type actually is, how type systems work and what polymorphism works.




is

Episode 29: Concurrency Pt.3

The third part of our concurrency series by Michael and Alexander discusses how to build highly scalable servers. The discussion focusses especially on event-driven servers. As possible solution patterns a reactor-based design is suggested along-side several patterns for multi-threading issues: Reader/Writers Locks, Thread Pools, and Leader/Followers.




is

Episode 30: Architecture Pt.3

In this third Episode on software architecture, Michael and Markus talk about the basic tools that an architect uses when architecting systems. These tools include things like separation, abstraction, compression and sharing. We also relate these tools to the quality attributes we introduced in previous archtecture episodes.




is

Episode 31: Agile Documentation

In this episode, our guest Andreas Rueping and Markus talk about documenting software. While this is a topic that many people don't like or consider fun, it is nonetheless very important. Based on his book, Agile Documentation, we talk about various aspects documenting software such as what to document, when to document, which media to use as well as specifically a number of layouting tips for nice documents.




is

Episode 32: Service Oriented Architecture, Pt.2a

In this, as well as in the next episode Eberhard and Markus continue their discussion about SOA (the episode got too long, so we had to split it into two ... SOA 2a and SOA 2b). In this episode, we talk about the various perspectives on SOA (CBD, EAI, BPM), about fundamental requirements towards an SOA, and we discuss the role of models in defining sustainable architectures. We also discuss how a programming model based on the described approach typically looks like. We then discuss a number of issues any large-scale SOA faces (and for which the SOA paradigm does not really provide an out-of-the-box solution: In this episode we discuss data type ownership and (weak) typing of data types.




is

Episode 33: Service Oriented Architecture, Pt.2b

This is the second snippet of the SOA 2 double-episode. Eberhard and Markus continue the discussion with the issue of service reuse and a couple of development process issues. We also look at the duality between infrastructure development and application development in the context of an SOA. We then discuss the great spaghetti misunderstanding :-). We conclude this episode with a look at how to integrate BPM into the conceptual SOA framework we've built up to now, and we'll also briefly skim over a number of technologies related to SOA. Note that this episode, as well as the last one, is based on a set of slides; these can be downloaded from here. This episode covers slides 39 through 74.




is

Episode 34: Enterprise Architecture

In this episode Markus and our Guest Andy Longshaw talk about enterprise architecture. More specifically, we talk about some of the patterns in Andy Longshaw's and Paul Dyson's book Architecting Enterprise Solutions: Patterns for High-Capability Internet-based Systems. These includes things like replication, load balancing, monitoring and application management.




is

Episode 35: Roadmap

This episode mainly outlines the upcoming programming and interviews.




is

Episode 36: Interview Guy Steele

This episode is an interview with Guy L. Steele Jr.. Guy is a Sun Fellow and heads the Programming Language Research Group within Sun, and a generally well known "programming language guy" (see here for details). We briefly talk about Lisp and the resurgence of dynamic languages before we delve into the main topic, the Fortress programming language he is working on. Fortress is a language intended to replace Fortran as a scientific computing language. We talk about how mathematical notations, syntax extensio and built-in support for parallelism are crucial properties of such a language. We then briefly talk about potentials for compiler optimization before taking a closer look at the type system (static typing, type inference), traits and contract specification as well as first-class support for hierarchical components. We conclude the discussion with a look at automatic partitioning and distribuion of concurrent algorithms and a brief look at the future roadmap for the Fortress language.




is

Episode 37: eXtreme Programming Pt.1

This is the first of two episodes where Arno and Alex discuss eXtreme Programming in se-radio's development process track. eXtreme Programming (XP) revolutionized the way of thinking about software development methodologies and helped to make the agile movement popular. In this episode they discuss the very basics of XP, its value system, principles and the basic practices used in an XP project. The second episode will continue the introduction adding the missing practices and how to introduce XP into projects.




is

Episode 38: Interview James Noble

Designers, programmers, engineers, we must all return to programming! Very few programmers tend to see their (sometimes rather general) difficulties as the core of the subject and as a result there is a widely held consensus as to what programming is really about. If these notes prove to be a source of recognition or to give you the appreciation that we have simply written down what you already know about the programmer's trade, some of our goals will have been reached.