Earnest Engineer

Ideally, thinking of security at the start of a project will mean more hard decisions and discussions and work up front, but a better implementation and product in the end. Like so much of software engineering, it's a team sport and an infrequently included group in security discussions are the designers, like the folks doing Human Centered Design (HCD or UCD), User Experience (UX) or whomever in your world takes care of designing the parts of the system the users touch. They can help a lot with designing security into a product and setting a cyber security mindset. The article on linked in ( https://www.linkedin.com/pulse/designing-security-lindsay-morsillo/ ) looks at this in more detail (7-10 minutes to read).

This I wrote to answer a question that came up when we were discussing our software process and I was training developers on how to unit test. It seems a simple enough question, but I kept pondering it and delving deeper until I realized I needed to write this monograph. What unit tests should we write? How do we know what to test? Ideally, unit tests should cover every path through the code. It should be your chance to see every path through your code works as expected and as needed. If you are practicing Test Driven Development then it's implied everything gets a test. In the real world, you might not be allowed to test everything - for instance, if the testing suite ends up taking a week to run, then the world will have changed by the time it finishes and the test results will be obsolete. Unit testing at it's basic is testing an object, a method - the smallest unit of your code that it can test independently. It should test the inputs "goes into" an...

This is part of what will be a series of articles about the practical aspects of using encryption as a developer. Very often, you are working with operating systems, frameworks and libraries that provide encryption services and it seems easy enough - load the library, create a key, call encrypt(...) and viola, you have encrypted your data! Or perhaps all you need to do is install a certificate and the underlying plumbing will take care of encrypting your communications. But what about... Which encryption algorithm should you use? How many bits of encryption do you need? How do you keep the key out of the source code? What's a cryptographic hash, an HMAC, salt, certificate authority, and etc...? Do we really need to bother with encryption? It's a lot of stuff often, and spread all over the internet and if you get it wrong, it can be bad. So, let's look at some of the good, trustworthy sources together. Like OWASP. Here is their fundamentals guide:  https:/...

To maintain secure computer systems, in the past the basics have been tasks like keep systems updated, run anti-virus software, use a properly configured firewall,use a filtering proxy for access to the internet. The advice on basics has been mechanistic in the past - make the machinery protect itself was the ideal and most hoped-for outcome. The new Basics include the old things and add: Establish a Security Culture Maintain Good Computer Habits  Plan for the Unexpected Control Access to Protected Health Information (from  Top 10 Tips for Cybersecurity in Health Care ) What's interesting about the new Basics is the additional items all have something in common: People. Each item focuses on how people interact with the systems, what they should expect and look for in terms of benefits, risks and dangers, and the fact the use of computers and computerized machinery must always remember the human elements for mistake, misuse and out-right abuse. Why Is Cyberse...

Right from the get-go, I was intrigued by this post which used the phrase "Data Liquidity" since this term is new to me, but I grasp a meaning for it right away. The post points out the importance of interoperability for care continuity and how this impacts value and quality driven care. As a technologist, ideas and concepts like this always interest me and it represents an area I've dealt with as a software engineer responsible for tying systems together into a coherent whole. I understand the need for continuing technology improvements in this area. But an even more frustrating and worrisome impediment to data liquidity are institutional barriers . I have often run into mazes of siloed data, groundless HIPPA fear-reactions, lack of data management infrastructures, turf wars and other strictly institutional impediments . I understand that hospitals and healthcare systems are large and complex organizations. But I find that often the data management policies in bu...

I have been immersing myself in the world of d3js and more, specifically Plotly.js . This has required me to look at palettes, and to create some palettes - which I did with Paletton . I find it tedious, so I am creating some helpers, like the code below which displays a given list of palettes (each of which is simply an array of colors in your favorite format). <table id="Palette"> <tbody></tbody> </table> <script> var defaultColorsPalette = ["#ffd99a", "#225ea8", "#ffc09a", "#9dc4f4", "#ffbf58", "#ffdb58", "#257294", "#ff9658", "#61a1f3", "#ffa719", "#ffce19", "#ff6e19","#ffe99a", "#2a82f2", "#ff9e00", "#ffc900", "#ff5f00", "#036bf0" ]; //via colorweb2 var sequentialMultihueBlueYellowPalette = ["#ffffd9", "#edf8b1", "#c7e9b4",...

This post from Robert Martin,  Stabilization , along with some recent lectures on Cyber-Security (from MIT's Srini Devadas) came together with the insight that both the "patch & pray" cyber security and the passive stabilization process are each pursuing negative goals. In other words, they are trying to prove the absence of bugs or vulnerabilities. Proving a negative like this is impossible - you'd have imagine and try every conceivable data input or attack vector. Since you can only really prove a positive (when the system get this, it does that) - then as Bob Martin suggests - you need to check that you have high test coverage, and subsequently high code coverage when running those tests - not just x hours of problem free run-time. In the security realm, just because you have a firewall and haven't seen that you've been hacked, you can't simply assume you are safe, you need to test applications for specific attacks, like SQL injection, or by port ...

A question: What does the following code do?  public static string GetThing1(string s)  {       return s.Substring(s.Length / 2 - (1 - s.Length % 2), 2 - s.Length % 2);  } Given that code, take a look at the following, what doe this code do? public static string GetThing2(string s) {     //Given a string return the middle char if odd, middle 2 if even     string retVal = "";     bool even = (s.Length % 2 == 0) ? true : false;     int middle = (s.Length % 2 == 0) ? s.Length / 2 - 1 : s.Length / 2;     if (even)         retVal = s.Substring(middle, 2);     else         retVal = s[middle].ToString();     return retVal; } It probably didn't take too long to figure out they both do the same thing.  They are two different answers to the following question: Write a function to get the middle character of a string. Return the mid...

Files as UI vs API  -  compares attributes of iCloud vs Dropbox. It starts on an interesting note - the model of a file system in the UI is dying, and should be let go. Beyond that it looks at mappings of each system to a file system from an API point of view and compares the successes of each. I find the initial thread the most interesting. Drop the mental model of a file system - which maps virtual concepts of files and directories to a physical model of papers, folders and file cabinets - and replace it with...what? This is a paradigm shift for me. I have to admit, I loath, hate, nay, despise looking for things. If I can't find something easily, it's only about a minute before I start growling and muttering things my mother would disapprove of. On this basis, I like the idea that I can save myself from thinking about where to put things or, where I have already put them. But how do we do this? It's non-trivial, since humans think of "things" and once they ...

This post by Michael Feathers intrigued me  Unconditional Programming . I like the different look at how to refactor - that's not a question I usually ask "How can I get rid of this conditional?"

So, Scott Hanselman struck a chord again:  Everything's broken and nobody's upset . The worst part is I can see that I'm part of the problem on both sides . I've excused many problems with software - shrugging as I restart the software or reboot. I save my anger for those occasions where I fell I've lost serious work and substantial time. Other than that I accept problems, glitches, crashes as "the cost of doing business". I believe it's actually because I've amused myself and earned a living creating software, that I am able to accept what's often pitiable quality. I've spent time working on systems that are not much more than breadboards with wires cascading from it, where getting something, anything to work was a huge accomplishment. But that was then and this is now. No way would I put up with a car that suffers from numerous small problems as today's software can. And putting these two thoughts together, it's now frightening ...

I write a lot of console apps and command line scripts or programs. I have found a pattern usage that makes it easier and neater to create these. It's an application of the Template method (see Design Patterns, Gamma et al). I divulged this favorite in a recent reply on Stack Overflow - check it out here

I liked this particular description of what makes a good programmer because it describes things about me! Really, I thought the "Appetite for learning" means a great deal - new languages, techniques, points of view all mix into the stew of ideas you bring to bear on a problem. Furthermore I loved this comment: "Lazyness. The need to spend 10 hours so that a 1 hour job can be done in 10 minutes."