Wednesday, May 26, 2010

The Kindle shares highlights

The Amazon kindle recently added a feature that shares "Popular Highlights" with other people. If many people highlight the same passage, then you'll see the passage highlighted on your own Kindle. If you select it, you'll see a popup showing a message like "11 other people highlighted this part of the book".

On one hand, this is a possible privacy violation. I don't see anything wrong with it yet, but it's exactly the sort of thing that makes me uncomfortable. Kindle shares your highlights this way by default, although you can turn off this feature.

On the other hand, it's a fascinating new way to read - something you can't get from paper. While reading, it encourages you to slow down and pay attention to what other people have found interesting. Likewise, if there is something that you think other readers should pay attention to, you are encouraged to highlight it for them. It's like a 21st century of a book club (where a group of friends read the same book and talk about it), but you are sharing your thoughts with the entire world.

I've read three books since Amazon published this feature (actually, since I've noticed this feature - not all books have highlights).

The first two are fictional novels, Nation by Terry Pratchett and Pirate Latitudes by Michael Chrichton. The thing I noticed in these books is that the highlights don't make sense - the passages aren't necessarily witty or insightful.

However, there does seem to be a rare word involved. For example, in Pirate Latitudes, the highlight (11 people highlighted it) started at the word "uxorial". I suspect that the reason those 11 people highlighted the passage is because they did not know the meaning of the word (I certainly didn't).

Do people highlight vocabulary words? Or is it an accident? The Kindle contains a built-in dictionary. Once you move the cursor to the word in order to see the definition, it's easy to accidentally highlight the word as well.

Highlight should be more meaningful for non-fiction books. The third book I've read recently is Ayaan Hirsi Ali's Nomad. This is a book critical of Islam and which promotes the values of the Enlightenment. It is political and controversial. I know that as I read it, I highlighted several sections I thought were interesting.

For example, she relates a story where as a translator were a 7-year old Somali kid beat up another kid at school. Her story told of the conflict she had as a translator that required not only translating the language but also the culture. The Somali family felt that the other kid (Mark) started the fight because he hurled insults at their kid (Mohammed). The school was adamant that Mohammed started the fight, because he threw the first punch. This is an incomprehensible cultural divide: Somali parents teach their kids to fight, to defend themselves from insults with violence. Western school teaches kids not to fight, to ignore insults.

I was interested by this anecdote, so I highlighted it.

But there were no Popular Highlights in this book from Amazon. This is probably because the book is so new, it's only been out a couple days. Maybe I should have put off reading it for a few months, to see what highlights others might be interested in.

Or, maybe I'll skim it again in a year, to see what other people have highlighted. This would be an awesome feature for Amazon: to allow me to browse a book based on the highlights they've got on their servers, so I don't have to flip through the pages myself.

So, for the last three books, the "Popular Highlights" feature has been a bust, but I have great hope for it in the future.

Saturday, May 22, 2010

You don't have executive buy in

When to fix low-priority items

There are two classes of security problems you need to fix.

The first is the "high priority" bugs, the ones with such severe consequences that you must fix them, even if they cost a lot to fix.

The other is the "low cost" bugs, one that cost so little to fix that, that it's worthwhile fixing them anyway even when they have no practical threat.

Programmers do this all the time. They fix "warnings" in their code simply to silence the warning-checker, even though there is no real problem with the code they've written.

Managing the process needs to be light-weight as well. Instead of individually tracked issues for every bug fixed by the programmer in this manner, there should probably be a single bug in the tracking database with the report. The programmer is given a budget of time to fix as many of the warnings they can, then at the end, report the number that they fixed.

Does buying a WAF solve the problem?

SDL is never done

Once 

Security bugs as functionality bugs

Security bugs aren't bugs.

A "bug" is when the software accidentally crashes. A "security bug" is when a hacker makes your software crash. If there were no hackers, there will be no "security bugs".

This is why support organization don't respond to security bugs, because they ask "are you a customer?", and the hacker says "no", so they respond "it's not a bug, only things customers report are bugs".

It's a light-bulg that needs to go off in everybody's mind, CEO, program manager, customer support, QA testers, engineers: some security problems are "bugs" or "features".

To start with, you can think of a "security bug" just like any other bug or feature request.

But that's not the entirety of secure development. There are things you would do for security that you would never do for normal bugs/features.

Temporary SDL

The first incident creates a temporary SDL: how do you fix the bug that caused the first incident.

After that incident is over, now go back and create your real SDL.