Slashdot Mirror

Reader Bill Camarda reviewed Wiley & Sons' Hack Attacks Revealed in June, 2001. Now Tom Brays has examined the book's second edition, and concludes that it's well worth the read. Read on below for his review of the second edition (and the the linked review of the first edition) to get an idea of how the new version stacks up. Hack Attacks Revealed: A Complete Reference for UNIX, Windows, and Linux with Custom Security Toolkit, Second Edition author John Chirillo pages 960 publisher John Wiley & Sons rating 9/10 reviewer Tom Brays ISBN 0471232823 summary All things considered, Wiley should have waited and released this first; this book pans out to be more of an original than a second edition and well worth the read.

The first edition instigated quite a bit of controversy with some glaring errata and misconstrued statements, and the author claims to have alleviated them as well as accommodating critiques:

The primary difference between this second edition and the original Hack Attacks Revealed, aside from some rectified errata, is approximately 300 pages of over 170 new exploits, advanced discovery techniques, malicious code coverage of Myparty, Goner, Sircam, BadTrans, Nimda, Code Red I/II and more, current vulnerabilities, advisories, and hacking labs with additional illustrations, and techniques for routers, operating systems (including Windows 2000/Pro and XP, Solaris, LINUX), and server software daemons. You'll also find a special chapter dedicated to the Top 75 Hack Attacks.

To accommodate the new material, most of the extraneous information, lists, and most source code was moved from the book to the CD-ROM. In addition to the new material, you'll find a special single license release of the internetworking security toolkit, TigerSuite Pro 3.5. This kit contains modules to discover, scan, penetrate, expose, control, spy, flood, spoof, sniff, infect, report, monitor, and more, plus a special 60-page usage and user guide.'

This book promises quite a bit in a new edition; let's see what's really in here ...

Okay, there are 914 pages (only about 15 or so with source code this time) and the chapter layout is completely different as the book starts with a Technology section, followed by Discovery, then Penetration, Vulnerabilities, and finally the Toolbox.

The technology section is nicely abridged to about 87 pages. The Discovery part differs greatly in that the source code has been moved to the CD and the author has added more coverage and examples, plus some stealthier techniques and more recent SNMP, file sharing, DNS, NetBIOS, and CGI stuff. The ports and services sections are still there but I found them to be pretty handy references at any rate. Also, the Penetration section now contains updated material; it's nice to see IDS stuff added in here too.

In addition, the Vulnerabilities section is promising. There's an excellent chapter in which Chirillo identifies what he considers the top 75 exploits -- examples that have certainly proven to be persistent examples of security weaknesses -- and the newer material especially makes this chapter significant. It contains thorough coverage as well as countermeasures for the listed exploits.

The CD contains some of the same plus full licensed software, an updated repository and all of the source code moved from the original text.

All things considered, Wiley should have waited and released this first; this book pans out to be more of an original than a second edition and well worth the read.

You can purchase Hack Attacks Revealed, 2nd Edition from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

PCM2 writes "The Columbine tragedy planted the idea of a certain kind of 'bad kid' into the American consciousness. He isn't social, he doesn't play sports, doesn't dress right. Maybe he spends more time with his computer than with the other kids in his class. It makes sense that he'd be a threat to his classmates, because he's weird. The consequences of this stereotype for the geek culture have already gotten a lot of air time on Slashdot -- most notably Jon Katz's Hellmouth series. So I immediately thought of Slashdot when I read Christopher Null's novel, Half Mast." Read on for the rest of PCM2's review. Half Mast author Christopher Null pages 219 publisher Sutro Press rating 7 reviewer PCM2 ISBN 0972098100 summary An interesting novel of murder among high school outsiders.

Alex, the protagonist of the story, is a geeky kid. He gets picked on. And he kills somebody because of it. But that's pretty much where the similarities between Alex and Dylan Klebold end.

What's refreshing about Half Mast is how the author accurately captures the world of a high-school outsider. Writers can be pretty introverted types themselves, but few of them end up killing anybody. So when they try to imagine the type of character who would, a lot of them tend to fall into the trap of inventing someone even more unfathomably nerdy than themselves. Thankfully, Null avoids this.

Alex isn't a complete, pathetic loner. He has friends. And together, Alex, Travis and James aren't the typical cookie-cutter stereotypes of kids too terminally dorky to get with the program. They're not so trollish that they can't get within booger-flicking distance of a girl, or so chess-club square that they wouldn't touch a drop of alcohol at a party (in fact, they spend much of their summers doing just the opposite). Null gets it: that most geeks aren't necessarily "deprived," and being an outsider isn't always about being excluded. It's about being different -- and that, in and of itself, can have its consequences.

In Alex's case, his nemesis is Steve Williams: hometown hero, star athlete, the pride and joy of Fall Valley High -- if you care about that sort of thing, that is. Alex doesn't, particularly. He fails to kowtow to Steve the way the way Fall Valley's golden boy thinks he deserves -- and here's where his proverbial troubles begin. Steve subjects Alex to a series of humiliating tortures that should have even the most picked-on geek cringing.

When Alex does finally strike back, it isn't with a hail of gunfire, either. He's calculating about it. I must admit, I'm not really convinced that Alex's modus operandi would actually pan out the way it does in Half Mast. But it certainly makes for more interesting reading than your standard shoot-out, and in its way, it's much more sinister. Also, because Alex doesn't have the option of the Columbine killers' quick way out, he's forced to live with his actions and their impact on his own life.

That's the book's focus, and what saves it from being just another wannabe crime thriller. Christopher Null cares about his characters, and he's taken care to depict them in a way that geeks will find sympathetic and (mostly) believable.

While a lot of Null's characters and situations were amusingly familiar, others rang less true. The Steve Williams character was a little too prone to making speeches about the relationship between bullies and their victims, for example, instead of just knocking Alex into the dirt the way the kids at my school would have done. There were also a few too many end-of-chapter "zinger" one-liners for my taste, and the novel uses the awkward device of a present-day journal talking about events that took place several years in the past.

Still, it's an impressive debut novel about an uncommon subject matter, and one I think a lot of Slashdotters would get a kick out of. Half Mast is a fast read, and an enjoyable one. It's also notable because the author chose to self-publish rather than go the traditional route. (Or maybe the topic was too "troublesome" for mainstream publishers in a post-Columbine world?)

You can purchase Half Mast from bn.com as well as from Null's own Web site at sutropress.com, which also has some excerpts from the book. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

shiroi_kami writes "What does Information Security mean to you? To many, it means firewalls and encryption. To some, it means intrusion detection systems. Chances are the words "file servers" weren't high on your list, but they probably should be. After all, information security is about information, and when it's not flying across the network it's got to be stored somewhere, right? In fact, the security of the storage mechanism is often overlooked, which makes it an attractive target for attackers. In their new book, Storage Security, the authors take a comprehensive look at this often-ignored subject. Update: 03/26 05:44 GMT by T : Please note, this review was written by David Bianco under the handle shiroi_kami as an Amazon.com review, and also appears at InfosecBooks.com. Apologies to David for the misplaced and delayed attribution. Storage Security: Protecting, SANs, NAS and DAS author John Chirillo, Scott Blaul pages 408 publisher John Wiley & Sons rating 9.8 reviewer David Bianco ISBN 0764516884 summary A storage security handbook that examines strengths and weaknesses, describes architectural security concerns and considerations, and identifies ways to implement and design more secure storage systems.

Storage Security is not about turning on the right configuration options on your XYZ brand server appliance. It's about applying solid, methodical security practices to your storage systems, regardless of whether they are disks directly attached to a single computer, Network Attached Storage or part of a Storage Area Network. The authors address the full security cycle, too, starting with evaluating the security of proposed new storage solutions. Comparative data in hand, the book shows you how to narrow the field to a single solution that offers the best balance between functionality and security.

And once the system is selected, you can't stop there. You've got to decide on appropriate security policies for the new storage system, draft and implement a backup and restore plan, deal with disaster recovery and take care of a host of other issues. In short, this is a good guide to an entire range of considerations necessary to select, deploy and manage a secure storage solution.

The book's evaluation methodology is particularly valuable. Each type of storage (directly attached, NAS and SAN) is covered in a chapter of its own. Within each chapter, the authors address specific technologies used to implement that type of storage. For example, the direct-attach chapter discusses such common storage technologies as SCSI and IDE, moderately exotic systems like USB and Firewire drives, and some more advanced solutions like HiPPI and SSA. Each technology is then placed in a matrix and scored in 11 different categories, including popularity and industry acceptance, built-in data protection features, typical fault tolerance and physical security characteristics.

The authors assign each rating on a scale of 1 (poor) to 5 (the best). This gives a good general indication of how each technology measures up, but they tend to rely on a straight average of the ratings when determining the best technology. Although it's true that the average allows you to make a quick ballpark comparison, there are many other factors to consider as well, such as the suitability for your particular environment and the way in which your users need to access their data. The matrixes are quite useful, but just remember that you can't always boil things down to a simple numerical score.

Probably the biggest problem with this book is that it's pretty dry. As a reference book, the writing style is fine, since it's easy to find what you're looking for, and the chapters are concise. It's difficult to read from cover-to-cover, though, which is a shame because that's what you should probably do the first time through. Take it in small doses, a chapter or so at a time, and you should be fine.

Storage Security is about just what you'd think: the security of your data as it's being stored on your server(s). It's not a detailed look at the configuration of any one product, but rather a comprehensive, theory-based approach to managing the security of your storage subsystem from evaluation to purchase to daily operations. If you manage a small or mid-size network, you may or may not need this book. If you have a larger network, though, or have significant data-storage needs, this deserves a space on your shelf.

You can purchase Storage Security: Protecting, SANs, NAS and DAS from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Max Tardiveau writes "I just finished Nassim Nicholas Taleb's Fooled by Randomness. It is an enjoyable book, written engagingly by an interesting character -- the kind of book that makes you think twice about certain things (for instance, the fact that you're not dead: is that really because you're so darn good, or does dumb luck play a part?) Although written all the way back in 2001, this book is more relevant than ever, since one of its major topics is the impact of unpredictable events on markets, insurance, and our perception of life in general. In fact, Taleb makes a living from unforeseen events; these days, that seems like a rather cunning niche." Read on for the rest of his review of this book. Fooled by Randomness author Nassim Nicholas Taleb pages 220 publisher Texere rating 8 reviewer Max Tardiveau ISBN 1587990717 summary Debunking fallacies of observation, Taleb reminds us of the pervasive ineffables that complicate life at every turn.

The main topic of the book is the fact that all humans are simply terrible at judging probabilities. Taleb is a securities trader, so a lot of the book revolves around financial probabilities, but his argument is mainstream and requires absolutely no knowledge of the markets. The book details examples of people wildly misjudging risks and probabilities in many contexts. Often that misestimation is understandable in advance of certain events, but harder to excuse after they've occurred; Taleb hits pretty hard on what he calls "data snoopers," his term for people who back-fit theories to existing data.

One of the most notorious examples is the Bible code (which has been thoroughly debunked), but Taleb argues that analysts who spend their time trying to find patterns in historical market data are no different: if you try long enough and hard enough, you will unavoidably find apparent regularities, which can be extremely compelling when seen in isolation. In context, though, they dissolve into nothing but meaningless statistical anomalies. Taleb rightfully compares these searches for meaning to the famous monkeys and typewriters parable.

Taleb's best example of poor probability intuition is probably the infamous survivor bias, which is our tendency to be disproportionately impressed by success. We almost always ignore the fact that, for one success story, there are many failures. But we seldom hear about the failures (just like we never hear about the many theories that didn't fit the data). So it's all a game of numbers: out of 10,000 traders, a few are statistically bound to be successful, even if they are nothing more than lucky idiots. The fact that they succeeded does not mean anything. It doesn't mean that they are bad traders, but it doesn't mean that they are good traders either, because on average somebody had to succeed.

One of Taleb's hot buttons is that people tend to be too confident in what they know. He argues convincingly that we should take everything, including science, with a grain of salt. Writing about Karl Popper, he points out that there are only two kinds of scientific theories: those that are demonstrably false, and those that are not yet demonstrably false. An irksome (but sadly true) observation, yet most people behave as if what they know is eternal truth. One could of course argue that Popper's observation is but another kind of truth, but I tend to put a lot more trust in people who question what they know than in people who don't.

Another of Taleb's peeves is the human tendency to over-attribute every random event (the old post hoc, ergo propter hoc). For instance, a commentator saying that "the Dow went down ten points today on concerns about Iraq" is talking nonsense: there is no way anyone can tie such a small market move to any particular reason. I found this specific point (which in retrospect is blindingly obvious) especially enlightening, as I am embarrassed to admit that, until now, I just accepted those market comments at face value.

Taleb also has some fun at the expense of economists and analysts, especially those whose predictions turned out wrong, but who claim that the theories were in fact right, and that the facts simply weren't supposed to be that way. This is what he calls denial of history, and is common among investors and gamblers (the two being of course close cousins).

The style of the book is informal and funny, and often meandering. We hop from one topic to the next, which occasionally may detract from the book's continuity, but overall the author's points come through loud and clear. Ironically for a man who advocates self-doubt, Taleb is starkly self-confident, though not in an irritating way.

Taleb is an intriguing, multi-cultural, iconoclastic character that has been around Wall Street for a while, and now runs his own small firm. Malcolm Gladwell (author of The Tipping Point, an absolute must-read for anyone who owns a brain) has written an excellent article that shows how Taleb's reasoning runs counter to just about every bit of conventional Wall Street wisdom. If you're interested in the markets, especially derivatives, and how Taleb trounces most of Wall Street's voodoo doctors, this moderately technical interview from 1996 is worth reading too.

Overall, a warmly recommended book.

You can purchase Fooled by Randomness from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Francis White writes "Hacker's Challenge 2 is the second volume in a series of books that present a series of real-world security scenarios and their solutions. For each scenario, information is given, clues are presented and questions are asked of the reader. Turning to the back of the book reveals what really happened along with suggestions and tips for how to respond to and possibly even prevent each presented attack." Read on for the rest of his review. Hacker's Challenge 2 author Mike Schiffman, Bill Pennington, Adam J. O'Donnell, David Pollino pages 352 publisher McGraw-Hill Osborne Media rating 9 reviewer Francis (Frank) White ISBN 0072226307 summary A computer security puzzle book with interesting challenges and detailed solutions

What It Covers

The scenarios in the book cover a wide range of current attacks. There are a few scenarios involving wireless access that each manage to point out a different facet of wireless security. Also, the book includes a few examples of network penetrations, a man in the middle attack, a bit of forensic analysis and the highly popular (in the media at least) "insider attack." One chapter focuses on exploit development using a simple stack overflow, which is a nice diversion.

The book's format is identical to that of the previous volume. Each challenge is rated Low, Medium, or High for Attack Complexity, Prevention and Mitigation. An account of each problem is presented (organized by date and time), often from the point of view of the person charged with figuring out what is happening or has happened. Logs are presented as they are requested by the investigator; the authors do a great job of following the thought processes and actions of the people responding to the incident as they discover each clue and take their steps forward.

At the end of each scenario description, there are a number of questions that generally help focus the reader's attention on the relevant parts of the scenario. After the reader comes up with some likely answers, he can turn to the back of the book where the solutions are found. Each solution is broken down into an explanation of the attack, how the attack could have been prevented, and steps to take to mitigate the effects of the attack after it has occurred.

The explanation highlights the clues that were presented, how they could have been used to solve the challenge, and the right (or wrong) steps the investigator took and why. Links to additional information and references are provided at the end of each solution.

The Authors

Hacker's Challenge 2 is written by Mike Schiffman (@stake), Bill Pennington (WhiteHatSec), Adam J. O'Donnell (working towards PhD at Drexel), and David Pollino (@stake). From the material presented, if not from their reputations and contributions to the computer security field (some of them under other names), the authors are obviously very familiar with analyzing and responding to security incidents. All of them contributed to the previous volume in the series. The book does not identify who wrote each chapter, unlike the first volume.

Why I Gave This Book A 9 I have read the previous volume in the series. I liked this volume a lot more, and while I was reading it, I tried to work out why. One of the possibilities I came up with is that they trimmed the number of authors from somewhere around ten, as they had used for the previous volume. The consistency of the writing and scenarios is greatly improved. The scenarios in this book are also much more interesting to me than in the previous book. It feels much more current than the previous volume. (I still recommend the previous volume, however, if you haven't been following possible attacks and countermeasures for a while. - I'd say I'd give it a 7.)

From the first chapter which opens with a still under-publicized layer-2 802.11 attack, it grabbed my attention. This is a great book for seeing not just what attacks are out there, but what attacks people in the security industry think are likely in the real world.

Like the previous volume, there doesn't appear to be much vendor bias in this book, which is always a welcome sight to me. Also, although the authors work in the security industry, they stay away from promoting themselves or their companies. (They do include links to some documents on company web sites, but they are technical documents, not marketing fluff.)

This volume is also packed with humor, although perhaps not everyone will appreciate or catch all of the jokes. My favorite quote in the book is from the chapter where "d4rkl0rd", a young novice hax0r who only speaks in l33t speak, is at the dinner table : "n0 m0m, 3y3 h4t3 gr33n b34ns, dUh!"

Conclusion I definitely recommend Hacker's Challenge 2 to anyone interested in, or responsible for, computer security. Even if you are very familiar with the subject, it's worthwhile to look over the attacks and solutions presented, and to compare the suggested response with the one you would use if presented with a similar scenario. The book is worth picking up even if you have read the previous volume, as it is of even higher quality, and covers, for the most part, completely different attacks. The format is easy to read and the real-world problem scenarios presented are interesting enough to keep you reading. The solutions are well presented and thorough, covering not just what happened in the attack and how to put the course of events together from the clues, but also ways to prevent and mitigate the attacks. Highly recommended. You can purchase Hacker's Challenge 2 from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

bADlOGIN writes "Anyone and everyone on Slashdot probably knows that business-driven software development efforts all too often end up as a mess. After a number of years of observation, research, and fine tuning, Ken Schwaber and Mike Beedle have released a book that makes a subtle but vital revelation about the nature of software projects and how to better run them. Learning what Scrum is and how to practice it is not all that profound. However, sitting back and realizing why Scrum works and how it addresses the fundamental flaws of the last 20 years of software engineering is. This book could be viewed as the "why" component to all of Extreme Programming's "how." Agile Software Development with Scrum author Ken Schwaber and Mike Beedle pages 158 publisher Prentice Hall rating 9/10 reviewer bADlOGIN ISBN 0130676349 summary This book could be viewed as the Why component to all of Extreme Programming's Hows. It explains managing software development as an empirical process.

What it's all about:

Books that claim to hold the keys to developing software the right way are most often: a) a dime a dozen, b) self-serving vendor drivel, or c) all of the above. While this book is fairly new on the shelf (Copyright October 2001), it has a level of research, professionalism, and effort towards being tool- and language-agnostic that may place it in a fourth category of being: d) none of the above. Agile Software Development with Scrum is a complete picture of the Scrum process from theory to practice in real life examples. The name Scrum was chosen because the process is similar in nature to rugby play where success is built upon being quick, adaptive, and self-organizing. The target audience for the book is "executives, software managers, project leaders, and programmers." While the authors make no assumptions directly, being familiar with Extreme Programming, "classic" waterfall methodology, and having hands-on experience with the chaos of software development is indeed helpful.

The primary theme of the book is simple, but the impact is profound: software development is an empirical rather than a defined process. That's a nice big sweeping claim to make: fortunately, the authors spends a lot of time making sure that you as the reader understand what they mean by the statement and that they're serious about it. Comparisons to other empirical processes are illustrated with examples of changing, complex problems. The authors seek out and provide unique insights from process dynamics experts on the nature of empirical versus defined processes, and cite profound supporting work regarding the limitations of algorithms in complex systems with external inputs (e.g. Wegner's Lemma).

Along with a good dose of theory, there is a generous helping of practice and how-to. Agile Software Development with Scrum covers the basic practices and concepts needed to manage software development in an empirical fashion. The authors do a good job of addressing the classic "but what about..." questions on the spot in a conversational manner and include anecdotes throughout to make specific points and include full process examples towards the end.

What's good about the book?

Scrum is the missing "why" to Extreme Programming's "how." By it's nature, Extreme Programming incorporates all of Scrum's spirit, and vice versa. This book has a foundation of ideas and an explanation of what it takes to seriously improve the state of the practice of software engineering. The order is reasonable, and the depth of information should give any determined individual the ammo they need to make a change in how software is developed in their current job or their next.

What could have been better? There are only three things worth mentioning for improvement, all of which could be easily done. First, there were occasional typographical and formatting errors -- places where indentation, capitalization, or bullets were missing broke the flow. Second, the graphics in more than one section were blocky, low resolution circa 1987. And last, the $30.95 list price was a bit steep for 158 pages. It should be noted that the typographical and graphics issues were the only thing that prevented me from rating this 10 out of 10.

Summary In my opinion, this book has been needed for a long time. The issues and failures of defined processes such as the "classic" waterfall methodology can't be set aside until there is an approach that can justify itself both in theory and in practice to replace it. Extreme Programming has gained much attention, but tends to depend too much on the fact that "it works because it works." Scrum gives you a way to fix your development efforts without as much culture shock or risk. It's worth considering implementing before your competition does.

You can purchase Agile Software Development with Scrum from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Kerberos99 writes "Mission Critical Security Planner is a timely and important book from Eric Greenberg, author of Network Application Frameworks (reviewed on Slashdot and used as a text in many CS courses). In Mission Critical Security Planner (MCSP),Greenberg advocates an actionable, meaningful security approach that doesn't get hung up on methodology or reliance on abstract standards, like DoD and other common standards." Read on for the rest of Kerberos99's review. Mission Critical Security Planner author Eric Greenberg pages 416 publisher Wiley rating 9.5 reviewer Kerberos99 ISBN 0471211656 summary Provides an innovative approach to create a customized security improvement plan, including analyzing needs, justifying budgets, and selecting technology, while reducing time and cost.

Greenberg delights in skewering bureaucracies that believe planning and methodology is an end in itself, yet recognizes key business realities facing security advocates and suggests practical approaches to "selling security" within an organization -- an important topic given tight or shrinking budgets.

Greenberg is clearly a security guy and writes with experience and authority -- at times the style is conversational and humorous and at others professorial -- it is a good read for a security-focused text. While providing a strong overview of sound security planning and risk management concepts, MCSP also digs down and provides details where it counts regarding filters, proxies, IDS/VA, configuration management, content management (ActiveX, etc), and so forth yet consistently presents this low-level detail within the framework of an actionable security planning methodology that will be relevant five or even ten years from now. MCSP is anything but a security cookbook of technology discussions gleaned from public sources, although many basic concepts and topics are explained in the book's comprehensive glossary. Instead, the book presents the strengths and weaknesses of various technologies and approaches as they relate to the security improvement process.

MCSP utilizes a sequence of sophisticated worksheets to guide the reader through the security planning process and create a dynamic, actionable security plan -- not a plan that lives on the shelf. Using Greenberg's approach there are three components to the Security Plan: Security Stack (physical, network, application, OS), Life-Cycle Stack (technology selection, implementation, operations, incident response), and Business (information, infrastructure, people). Interestingly, you may have noticed that the Security Stack is similar to the OSI model -- this is typical of the rational and logical approach throughout the book. Using the worksheet approach as a guide, the Security Plan is mapped to 28 pre-defined security elements addressing the core security planning challenges of a distributed computing environment. Based on the worksheets, the impact analysis method approach provides a readily understandable plan that reflects the specific business, technical, and lifecycle tradeoffs in your organization.

Greenberg keeps it interesting with many anecdotes illustrating key points and thought-provoking arguments. For example, he advocates an approach that will hold vendors accountable for poor security by providing a quantifiable method for business software users to track security. The final chapter covers strategic security planning with PKI and provides a roadmap for selling an organization on the benefits of PKI when appropriate.

MCSP is an innovative and useful security book. The book provides security staffers and planners with the logical framework and tools they need to create a comprehensive, living, and actionable security plan enabling the organization to shift from a reactive security posture to a more pro-active approach. Highly recommended.

Online reader resources are available and chapter one maybe downloaded from http://www.criticalsecurity.com.

Table of Contents

• Chapter 1: Setting the Stage For Successful Security Planning.
• Chapter 2: A Security Plan That Works
• Chapter 3: Using the Security Plan Worksheets: The Fundamentals
• Chapter 4: Using the Security Plan Worksheets: The Remaining Core and Wrap-Up Elements
• Chapter 5: Strategic Security Planning with PKI
• Chapter 6: Ahead of the Hacker: Best Practices and a View of the Future

You can purchase Mission Critical Security Planner from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

chrisd has taken time off from polls and posting to both read and review Richard Rhodes' The Making of the Atomic Bomb. Read on for his impressions of the book, which he says is "not really a story about the men so much as the science they pursued." The Making of the Atomic Bomb author Richard Rhodes pages 886 Pages publisher Touchstone/Simon and Schuster rating 5 out of 5 uh, somethings reviewer Chris DiBona ISBN 0684813785 summary How the bomb came to be.

Lansing Lamont's Day of Trinity was the first book I read about the Manhattan Project. In what turns out to be a decent if uncritical look at the pursuit of atomic weaponry, Lansing was given exclusive access throughout the life of the Manhattan Project. In reading the book you feel like you have a fly-on-the-wall view of the process of producing the first uranium and plutonium bombs.

Lamont's telling is a bit thin though, not going into the motivations of the scientists and only barely touching on the geopolitical situation at the time. This not to say that it is craven, but it is overly sympathetic and a bit too rah-rah about atomic weaponry and their usefulness.

In the book, Mr. Rhodes takes the time to explore the base motivations of the scientists. Ever wonder exactly what motivated Teller's bloodthirstiness? What inspired the scientists to continue driving toward the atomic prize even after the fall of Germany? Rhodes has spent the time researching exactly what made the major players tick.

This is all well and good, but probably the most enjoyable thing about the book is how it's not really a story about the men so much as the science they pursued. The book is not really about the bombs, either, but more the history of physics and physicists.

Always keeping the science accessible and exciting, he manages to explain concisely the process of discovery and experimentation and how the significant events of history affected both the project's progress.

The way that Mr. Rhodes tracks the movements of physicists from anti-semitic Germany to Los Alamos, Chicago and other centers of the nuclear arms program is especially compelling and lends keen insight into the motivations of the physicists involved.

One of the most important (and stomach churning) things about the book is how it shows how cheap human life became in the first half of the 20th century. I think that it is important, when considering the horror of dropping bombs on Hiroshima and Nagasaki, that people have the proper historical context before coming to one conclusion or another about the morality of the dropping of the bomb. This book gives that context.

This is not to say that this is a perfect book. Reaching as it does from the mid 1800s through to the dawn of Teller's super-bomb, the book's scope means that some discoveries and scientists don't get the in-depth coverage that Bohr, Szilard and Oppenheimer do, and he doesn't talk much at all about the espionage that surrounded nuclear development. Nor in my mind does he fully answer the question of why the scientists remained motivated to produce the weapons after Germany had been conquered.

Those caveats aside, this is a terrific book well worth checking out if you are interested in the birth of modern physics, the men and women behind it, or the most powerful weapon that has ever been used on humans.

You can purchase The Making of the Atomic Bomb from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

PinglePongle writes with this review of Addison Wesley's Extreme Programming for Web Projects, writing "The authors work for a web shop, building websites for customers, and try to use their experience to make life easier for their readers. Their main point concerns how traditional web projects are structured to leave at least one of the parties taking a big risk on the project: if the project is 'fixed price, fixed scope' the developers take all the risk, if it's 'time & materials' the customer takes a risk -- they can not be sure their money will lead to whatever it is they want." Read on to see whether the authors have successfully outlined a fairer, more successful system in the rest of PinglePongle's review, below. Extreme Programming for Web Projects author Doug Wallace, Isobell Raggett, Joel Aufgang pages 165 publisher Addison Wesley rating Poor reviewer PinglePongle ISBN 0201794276 summary A book about applying the Extreme Programming methodology to web projects.

Can good ideas dominate the buzzwords? This risk -- the authors contend -- is the reason many web development projects fail in one way or another. The client's objective is to obtain maximum value, the developer's to incur the least cost possible without getting sued.

The authors show a way in which this risk can be shared fairly between the client and the developer, by using XP and iterative development cycles, alongside a release plan, to acknowledge the risks inherent in a development project, and manage them rather than try to pretend they don't exist. The project team -- client and developer -- work together to create an iteration plan, and use this shared understanding of the requirements to guide the project.

The book is structured into 4 parts: Part 1: XP and Web Projects explores the problems associated with web development projects. Part 2, Working on Web XP Projects explores some of the practicalities of the authors' process - iterative development cycles, the development environment, team roles, and the graphic design process. Part 3: XML and Web XP is a bit of an oddity in a methodology book -- it focuses on some technology-specific issues which the authors claim can be addressed by using XML. Part 4: Web XP Best Practices discusses planning, design, coding and testing issues.

What's good about this book? Well, there are some insights into the relationship between suppliers and customers in development projects. (I don't believe, though, that they're as specific to web projects as the authors seem to claim).

What's bad about this book? It seems to be a sales brochure for the author's web shop -- "we do things thusly, and it yields fantastic results every time." The text is full of fairly broad, even sweeping statements ("Many programmers put SQL code right on a web page" -- when was the last time you saw a select statement on a web page ?).

The authors do not really seem to be able to identify those aspects which make web development projects different from other types of development. Some of the team roles they recommend are bizarre -- the authors identify the role of "Strategist" who seems to help those poor idiot customers to understand their own business. This may be necessary on some projects, but I find this attitude very condescending -- the days when web development was portrayed as a cross between alchemy and spiritual enlightenment are long gone. Many of the sections are very superficial, but the book is littered with footnotes saying "Chapter X discusses this in detail."

In short, I'd say this book is too lightweight for people who understand XP already and want to learn how it applies to web projects, and novices are likely to get hung up on the largely redundant side tracks (CVS versus MS Sourcesafe -- Huh? How did that get past the editors?) to be able to see the extreme wood for the trees.

You can purchase Extreme Programming for Web Projectsfrom bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

rjnagle writes "The availability of HOW-TOs and newsgroups is supposed to make the sysadmin's job easier, right? Much as I am a proponent of the 'distributed learning model' for Linux, the endless searching for answers on the Web for setting up Linux RAID was getting to be a royal pain. Sure, there was a RAID how-to and an excellent newgroup, but some of the information is out of date, and the tricks suggested by people a year ago may be no longer needed today. Robert reviews the O'Reilly title Managing RAID on Linux below to see how it stacks up to HOWTOs, guesswork and anecdotal evidence. Managing RAID on Linux author Derek Vadala pages 245 publisher O'Reilly rating The best reviewer Robert Nagle (aka idiotprogrammer) ISBN 1565927303 summary This book brings RAID to the masses

A person deciding to go with RAID faces a panoply of options and gotchas. Hardware or software? How many controllers? ATA or SCSI (or ataraid)? RAID 1 or RAID 5? Which file system or distribution? Kernel options? Mdadm or raidtools? /swap or /boot on raid? Hybrid? Left or right symmetric? One poster pointed out that putting two ATA drives on the same controller could impact performance. Yikes! Didn't I do that? Upon discovering that O'Reilly had just published its Managing RAID on Linux book, looking at sample chapter , I bought the book and let my blood pressure return to normal.

RAID is one of these subjects that is really not complex; it's just very hard to find all the information in one place. This is precisely the book to solve the problem. Author Derek Vadala, sysadmin and founder of Azurance.com, an open source/security consulting firm, has gathered a lot of information and even personal anecdotes to go through the decision making process when going over to RAID. He goes step-by-step through that process, educating us about hard drives, controllers, and bottlenecks along the way. This exhaustive book may be the first to bring RAID to the masses.

Although parts of the book (RAID types, file system types) may seem already familiar to experienced Linux users, it is helpful nonetheless to have everything in a nifty little book. A section of file systems provided not only a rundown of the merits and drawbacks of each one, but also a guide to their utilities. I learned for example what "file tails" for Reiser are, and why using them causes performance to degrade after reaching 85% capacity. The book compares raidtools with mdadm as well as lovely commands like nohup mdadm -monitor -mail=paranoidsysadmin@home.com (which, if you haven't guessed, causes the system to email you RAID status reports upon boot).

People who use software RAID may skip over the chapter on RAID utilities for the leading RAID controller cards. Still, there was one interesting tidbit: Why, the author asks, do makers of controller cards put all their BIOS utilities on DOS floppies which require us to find a DOS boot disk? Seriously, how many of us carry around DOS boot disks nowadays? The book made me aware for the first time of freedos, an open source solution that solves precisely that problem.

The Software RAID stuff was pretty thorough and clarified a lot of things. The book does an excellent job in helping to identify and eliminate bottlenecks and optimizing hard drive performance (using hdparm and various monitoring commands). The anecdotes and case studies definitely clarified which RAID solution is suited for which task.

I am less impressed by the book's sections on disaster recovery and troubleshooting. Although these subjects are brought up at several places in the software RAID chapter, the book could have discussed several failure scenarios or used a fault tree (such as the famous Fault Tree in Chapter 9 of the Samba book, a marvel for any tech writer to read). The book doesn't even discuss booting with software RAID until the last 10 page of the book and then gives it only a single paragraph (even though the author acknowledges it as "one of the most frequently asked questions on the linux-raid mailing list."). Call me old-fashioned, but isn't the ability to boot into your RAID system ... kinda important? As someone who just spent a significant amount of time troubleshooting RAID booting problems in Gentoo, I for one would have liked more insight into the grub/lilo thing. Also, in the next paragraph in the last chapter on page 228, the author casually mentions that "all /boot and / partitions must be on a RAID-1." Say what? Please pity the poor newbie who religiously follows the instructions in the book but fails to read until the end. I'm not sure what the author meant by this statement, but it required a much more substantial explanation and needed to go into a much earlier chapter.

These complaints don't detract very much from this excellent book, a true O'Reilly classic and a model of clarity and helpfulness. This book provides enough knowledge to avoid the dread and uncertainty that comes with trying to tackle Linux RAID. With a book like this, a sysadmin can sleep a little easier.

Recommended Readings:

• Reliable Linux , by Iaian Campbell, Wiley and Sons, Dec 2001, ISBN: 0471070408. Gives excellent information not only about RAID but on general Linux reliability issues.
  
• Software RAID in the Linux 2.4 Kernel by Daniel Robbins. (Part Two).
  
• Linux Journal Article on Software RAID by Joe Edwards, Audin Malmin and Ron Shaker. ( Part Two).
  
• "How to do a gentoo install on software RAID" by Chris Atwood. Gentoo User Forum.

Robert Nagle (aka Idiotprogrammer )is a Texas technical writer, trainer and Linux aficionado. You can purchase Managing RAID on Linux from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

rjnagle writes "The availability of HOW-TOs and newsgroups is supposed to make the sysadmin's job easier, right? Much as I am a proponent of the 'distributed learning model' for Linux, the endless searching for answers on the Web for setting up Linux RAID was getting to be a royal pain. Sure, there was a RAID how-to and an excellent newgroup, but some of the information is out of date, and the tricks suggested by people a year ago may be no longer needed today. Robert reviews the O'Reilly title Managing RAID on Linux below to see how it stacks up to HOWTOs, guesswork and anecdotal evidence. Managing RAID on Linux author Derek Vadala pages 245 publisher O'Reilly rating The best reviewer Robert Nagle (aka idiotprogrammer) ISBN 1565927303 summary This book brings RAID to the masses

A person deciding to go with RAID faces a panoply of options and gotchas. Hardware or software? How many controllers? ATA or SCSI (or ataraid)? RAID 1 or RAID 5? Which file system or distribution? Kernel options? Mdadm or raidtools? /swap or /boot on raid? Hybrid? Left or right symmetric? One poster pointed out that putting two ATA drives on the same controller could impact performance. Yikes! Didn't I do that? Upon discovering that O'Reilly had just published its Managing RAID on Linux book, looking at sample chapter , I bought the book and let my blood pressure return to normal.

RAID is one of these subjects that is really not complex; it's just very hard to find all the information in one place. This is precisely the book to solve the problem. Author Derek Vadala, sysadmin and founder of Azurance.com, an open source/security consulting firm, has gathered a lot of information and even personal anecdotes to go through the decision making process when going over to RAID. He goes step-by-step through that process, educating us about hard drives, controllers, and bottlenecks along the way. This exhaustive book may be the first to bring RAID to the masses.

Although parts of the book (RAID types, file system types) may seem already familiar to experienced Linux users, it is helpful nonetheless to have everything in a nifty little book. A section of file systems provided not only a rundown of the merits and drawbacks of each one, but also a guide to their utilities. I learned for example what "file tails" for Reiser are, and why using them causes performance to degrade after reaching 85% capacity. The book compares raidtools with mdadm as well as lovely commands like nohup mdadm -monitor -mail=paranoidsysadmin@home.com (which, if you haven't guessed, causes the system to email you RAID status reports upon boot).

People who use software RAID may skip over the chapter on RAID utilities for the leading RAID controller cards. Still, there was one interesting tidbit: Why, the author asks, do makers of controller cards put all their BIOS utilities on DOS floppies which require us to find a DOS boot disk? Seriously, how many of us carry around DOS boot disks nowadays? The book made me aware for the first time of freedos, an open source solution that solves precisely that problem.

The Software RAID stuff was pretty thorough and clarified a lot of things. The book does an excellent job in helping to identify and eliminate bottlenecks and optimizing hard drive performance (using hdparm and various monitoring commands). The anecdotes and case studies definitely clarified which RAID solution is suited for which task.

I am less impressed by the book's sections on disaster recovery and troubleshooting. Although these subjects are brought up at several places in the software RAID chapter, the book could have discussed several failure scenarios or used a fault tree (such as the famous Fault Tree in Chapter 9 of the Samba book, a marvel for any tech writer to read). The book doesn't even discuss booting with software RAID until the last 10 page of the book and then gives it only a single paragraph (even though the author acknowledges it as "one of the most frequently asked questions on the linux-raid mailing list."). Call me old-fashioned, but isn't the ability to boot into your RAID system ... kinda important? As someone who just spent a significant amount of time troubleshooting RAID booting problems in Gentoo, I for one would have liked more insight into the grub/lilo thing. Also, in the next paragraph in the last chapter on page 228, the author casually mentions that "all /boot and / partitions must be on a RAID-1." Say what? Please pity the poor newbie who religiously follows the instructions in the book but fails to read until the end. I'm not sure what the author meant by this statement, but it required a much more substantial explanation and needed to go into a much earlier chapter.

These complaints don't detract very much from this excellent book, a true O'Reilly classic and a model of clarity and helpfulness. This book provides enough knowledge to avoid the dread and uncertainty that comes with trying to tackle Linux RAID. With a book like this, a sysadmin can sleep a little easier.

Recommended Readings:

• Reliable Linux , by Iaian Campbell, Wiley and Sons, Dec 2001, ISBN: 0471070408. Gives excellent information not only about RAID but on general Linux reliability issues.
  
• Software RAID in the Linux 2.4 Kernel by Daniel Robbins. (Part Two).
  
• Linux Journal Article on Software RAID by Joe Edwards, Audin Malmin and Ron Shaker. ( Part Two).
  
• "How to do a gentoo install on software RAID" by Chris Atwood. Gentoo User Forum.

Robert Nagle (aka Idiotprogrammer )is a Texas technical writer, trainer and Linux aficionado. You can purchase Managing RAID on Linux from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

nanojath writes "The title of William Gibson's latest release, Pattern Recognition, seems particularly appropriate. While widely noted for its 'departure' from Gibson's usual genre in that it is set in the more-or-less present day, the themes, characters, and plot devices of Pattern Recognition are fully in line with the Gibson canon. Whether this is a good thing will depend greatly on the individual reader, Neil Gaiman's assertion that it's Gibson's best effort since Neuromancer notwithstanding. The short version: readers who enjoy Gibson's later work will probably find this typically fast-paced mystery to be a satisfying read, if not their favorite example among his post-Eighties efforts. Those who feel that Gibson's fire has been progressively dwindling as he navigates middle age will probably feel that Pattern Recognition is more of the same, the fast-forward technology of Neuromancer an increasingly muted backdrop to the main attraction of psychological and sociological themes." Read on for the rest of nanojath's review. Pattern Recognition author William Gibson pages 368 publisher Putnam rating 7 reviewer Jonathan Hamlow ISBN 0399149864 summary Gibson turns his trademark fast-forward speculative lens on the present with a compelling novel of a marketing savant's search for a mysterious artist. Despite its strengths, Gibson's latest novel has serious flaws.

Pattern Recognition's Cayce Pollard is very much a Gibson protagonist -- a somewhat hapless but sympathetic outsider with a unique sensitivity for a particular class of data. Cayce has what is termed an "allergic" sensitivity to the peculiar cultural ephemera of marketing and branding, and employs the sometimes-debility (she experiences something akin to a panic attack, for example, in the presence of too much Tommy Hilfiger) as a highly paid consultant in the survival-of-the-fittest ecology of the 21st century marketing industry.

She is also a "Footagehead," a member of an internet-based community which obsessively follows and theorizes about a series of enigmatic film clips, apparently components of a larger work, which surface anonymously and without announcement in the various uncharted archives of the internet.

Cayce is led by her current employer (a Millennial marketing savant who's Swiftian name, Hubertus Bigend, is easily the funniest thing in the book) into a search for the creator of the mysterious footage. At the same time, she is plagued by an apparent conspiracy of intimidation, involving the systematic invasion of her privacy and an exploitation of her "brand allergy" gift, and haunted by memories of her father, a security consultant who disappeared in New York in the aftermath of the September 11th attacks on the World Trade Center, and seems almost certainly, but not provably, dead. Her search leads her into the labyrinth depths of post-cold-war politics and economics -- depths it seems she may find increasingly difficult to navigate a path out of.

Comparisons to Gibson's earlier works are easy to find in Pattern Recognition. Its main character, with her savant informational talent, brings earlier characters like Case, Laney, and Silencio to mind. Her wealth-facilitated search for the artist of the Footage is strongly reminiscent of Marley's search for the boxmaker in Count Zero (and in fact Hubertus Bigend seems a more benevolent but still creepy combination of Virek and Cody Harwood). Certainly there seems to be a certain self-conscious recognition of these comparisons in the fact that Gibson gives his female protagonist a name phonetically equivalent to Case. Pattern Recognition is also Gibson's first novel since Neuromancer to follow a single point-of-view throughout the entire book. In this and many other respects it has a simpler and more direct story than any other Gibson novel, though it is driven by the mystery angle and contains no shortage of twists and turns.

I tend to like Gibson books better in multiple readings and I'm curious to see if this effect holds for Pattern Recognition. My first reading impression is that, while a well-written and enjoyable page-turner, this is Gibson's weakest work. The translation of his trademark savant talents, ubiquitous technology, idiosyncratic artists and post-modern robber barons to a recognizable present-day reality is hit-and-miss. Story elements that might pass easily enough in a world of the not-too-distant future ring false in this version of the present, where the comparison to what actually is is constantly invited. Likewise, the introduction of September 11th is forced and suspect. There is something slightly off in Gibson's portrayal here, something revealing that after decades as a Canadian expatriate, Gibson cannot fully align with the American viewpoint any longer. And it is perhaps to soon for this very real human tragedy, whatever its sociopolitical lessons and consequences, to be used as a plot device in a work of speculative fiction. I wasn't fully satisfied by the answer to the mystery of the Footage artist, which seemed contrived, and found the resolution of the story to contain altogether too much deus ex machina.

Gibson's facile prose and knack for telling a fast-paced and compelling story prevent these problems from derailing Pattern Recognition altogether. The book is readable, enjoyable, and not without satisfaction. Gibson is to be admired for risking a chance on a fairly radical direction in his genre and taking on the altogether less malleable present in favor of the endless possibilities of the future. The depths to which he mines his own material speaks, perhaps, to the strain of this effort. Fans will probably accept Pattern Recognition's addition to the Gibson canon, detractors of his latter works will no doubt see it as further evidence of his decline. I hope that it indicates a tentative but promising step into a larger world of narrative possibilities for Gibson, and that this promise will prove itself as our stranger-than-fiction present evolves continuously into the future.

You can purchase Pattern Recognition from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

benjiboo writes "This is one of the many books designed to help the average technical manager or developer get a feel for what the .NET framework means for them. Primarily geared towards developers and technical managers, this book aims to cut through the marketing hype. But, does it succeed? Read on for Benjiboo's answer to that question. Understanding .NET: A Tutorial and Analysis author David Chappell pages 288 publisher Addison-Wesley rating 4 reviewer Benjiboo ISBN 0201741628 summary A summary of the .NET framework

Firstly, this book doesn't attempt to act as a programming tutorial, and as a result is thin on code examples. Instead, the book takes a highly summative approach to the main technologies of the framework, broadly dividing them into: web services, the CLR and languages, the class library, data access, ASP.net and .NET my services.

Having said this, the central theme through the book is that of XML and web services, accurately reflecting their importance in the .net framework. It frustrates me how web services are often described as revolutionary, when built on technologies such as UDDI and WDSL which in turn are based on relatively mature technologies such as XML and HTTP. This book falls into the same trap of pandering to the hype surrounding web services, without really managing to convince me of what is so revolutionary about them.

The author dedicates a chapter to a summary of the main .NET languages, Visual Basic .NET, C#, and the managed extensions of C++. The author concludes that "Managed C++ adds even more complexity to an already complex language." Some may have reservations with this statement; garbage collection, interfaces, attributes and the managed types are only likely to result in less work for the developer even after a relatively short learning curve. The author appears to come out in favour of C# over the "more complex" Visual Basic. I would like to have seen some discussion on other .NET languages under development.

The chapter on the class libraries makes a relatively good job of summarising the massive .NET libraries. It's a fleeting overview of the most useful and interesting parts of the libraries. Remoting (remote method calls), reflection and the ubiquitous GUI libraries are just a few examples. This is one of the stronger sections of the book in my opinion, though this is coming from a developer's perspective.

There is a concise chapter on ADO .NET. The author acknowledges the fact that this is the latest in a long line of Microsoft data access libraries but fails to indicate why this one is better. The controversial .NET My Services is also detailed. The book doesn't really ponder the politics surrounding My Services, which is surprising as this element was always likely to be its downfall.

In parts, this book is overwhelmingly pro-Microsoft. In a particularly gushing moment, the author implies that COM was successful in its goals of interoperable component software, only failing to reach critical mass due to a failure by other vendors to support it. OMG's corba on the other hand was based on an incomplete standard, destined to failure due to Microsoft's decision not to support this 'doomed' standard. I would whole-heartedly disagree with this. Firstly, the distributed object technologies of CORBA are applicable to a different range of problems. Even overlooking the validity of this comparison, CORBA has seen massive support and is generally considered to be more successful than COM.

On a more positive note however, this book does provide isolated moments of insight. Some of the sidebars, for instance, tend to delve a little deeper, providing a little bit of the insight I was hoping to gain by reading this book. A brief look at the differences between MSIL and Java's VMs for instance led me to research further. Apparently future versions of SQL server are set to host a version of the .NET CLR natively, similarly to how Oracle 9i can run its own Java VM. For me, these insights go beyond the information which I could have picked up on any number of white-papers out there on the net.

In hindsight this book is perhaps too shallow, falling into the trap of using a barrage of acronyms and buzzwords without delving deep enough into any one topic. There is no mention of cross-language interoperability, and more importantly no mention of cross platform interoperability efforts -- which do exist. Also, even with a book so Microsoft oriented, I would expect to see either a distinct section, or at least more comments, on the pitfalls and barriers to takeup of the framework. A more critical and less Microsoft-centric text would for me have made this book more authoritative.

Table Of Contents

Preface
1. An Overview of .NET. 2. Web Services.
3. The Common Language Runtime.
4. .NET Languages.
5. The .NET Framework Class Library.
6. Accessing Data- ADO.NET.
7. Building Web Applications- ASP.NET.
8. .NET My Services.
Conclusion

You can purchase Understanding .NET: A Tutorial and Analysis from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Reader yamla writes with the following review of Mike and Phani's Essential C++ Techniques from APress. Yamla finds a few bright spots in this book, but also several weaknesses. Read on to see whether you fit into the group he says would find this book useful. Mike and Phani's Essential C++ Techniques author Michael Hyman and Phani Vaddadi pages 239 publisher APress rating 2/10 reviewer Chris Thompson ISBN 1893115046 summary This book is useless to any other than the beginning Visual C++ 6.0 students.

The major problem This book has one killer problem: It is not aimed at C++ programmers. Let me be more specific here; it is not aimed at ANSI C++ programmers. Instead, it is aimed at Microsoft Visual C++ 6.0 programmers.

Is this a big deal? Yes. The cover of the book is rife with mentions of C++. It even mentions ANSI C++. There is one, and only one, reference to Visual C++ on the cover of the book. Even inside, the index lists only three references to Visual Studio, none to Visual C++. With quotes such as 'Hundreds of tips and techniques for advanced C++ programmers' on the cover, I was very surprised to realise this book is for Visual C++ 6.0 users only. At best, the cover of this book is misleading.

The rest of this review (and the book's rating) assumes you are still interested in the book. You therefore use only Visual C++ 6.0 and have no plans to upgrade.

Other problems

For a book apparently aimed at intermediate and advanced programmers, this book contains a lot of tips that any experienced beginner should already know. Techniques such as ensuring you never return a pointer to an automatic variable really have no place in a book with the stated audience. Really, this book would be more suited to programmers who were still learning C++.

Except there are a number of other issues that make this book poorly suited to people learning C++. Instead of using standard C++ strings, this book chooses NULL-terminated C strings. Files are not included the C++ way (cstdio instead of stdio.h, iostream instead of iostream.h). The STL is not mentioned at all, with dynamic arrays having their own chapter rather than a simple mention of vectors and with an entire chapter devoted to code for sorting instead of showing the programmer how to use the STL sorting algorithms. The smart pointers? Either use the built-in autoptr or use boost.org's vastly superior implementation.

Some good stuff

This book is not completely without redeeming qualities. Many of these techniques are good and useful. If you are a new Visual C++ 6.0 programmer and you are learning from a substandard text, you may find this book covers some of the shortfalls of your other textbook. Similarly, if you are taking a class in C++ and your instructor is particularly lousy, this book could help you out.

Summary

Mike and Phani's Essential C++ Techniques is useless to any other than the beginning Visual C++ 6.0 student. It ignores ANSI C++ to focus instead on Microsoft's implementation. It contains a number of stylistic problems, relying far too heavily on C instead of the facilities provided by C++. And finally, it only covers techniques any reasonably experienced C++ programmer should already know.

You can purchase Mike and Phani's Essential C++ Techniques from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

gse writes "I first heard about Po Bronson's What Should I Do With My Life? here on Slashdot a few weeks ago, then read more about it on NPR. I found these articles and excerpts compelling and inspiring, so I picked up the book. Before I get into the review, some quick background on me so it's clear where I'm coming from: I'm a geek. I've been programming since I was a little kid, I have a computer science degree, I contribute to open source projects, I've been coding professionally for ten years. I am "successful" in my career. But I've found my day job unfulfilling for years, and as a musician I often wonder if I should follow my heart elsewhere. I imagine I'm not the only Slashdot reader who fits this description." Read on for Scott's take on this book. What Should I Do With My Life? author Po Bronson pages 400 publisher Random House rating not perfect but worthwhile reviewer Scott Evans ISBN 0375507493 summary Dozens of "real people" refactor their lives and careers in pursuit of happiness.

Given all that, I figured What Should I Do With My Life? was pretty much written for me. The book tells the true stories of dozens of people who made hard decisions and gave up careers, educations, and lifestyles in order to give themselves reasons to get up every morning, and maybe to find true happiness. In researching the book, Po Bronson interviewed nearly a thousand people all over the US, and got to know some of them very well. He intertwines their stories with his own personal tale, and often pauses between stories to reflect on everything he saw and learned while writing the book.

So how's the book? Good and bad.

I had hoped to distill some great truth from these stories -- to leave with a clear sense of the changes I have to make, and with the resolve to make them. No dice. To be fair, Bronson never promises any such thing; in fact, he promises quite the opposite. And rightfully so. There are certainly no silver bullets here.

But my real problem with What Should I Do With My Life? is that I couldn't identify with so many of its subjects, and eventually that turned me off. It felt like four out of five people had law degrees or worked in finance or politics. Very few were geeks, or even grunt-level office 9-to-5'ers. In his introduction Bronson says "the people in this book are ordinary people," but it didn't feel that way. An ex-doctor whose father was a famous cardiologist; a Hollywood production executive; an established Hollywood screenwriter; CFOs, CEOs; guys that sold startups for millions. A PhD marine biologist who "quit and became a dentist." Wowie.

Even Bronson's generalizations alienated me. The "we" that define ourselves by our salary or possessions or career achievements -- that's not my "we." I think (hope?) Bronson has spent so much time in Silicon Valley culture that he's over-projecting. Maybe I'm not ambitious enough, but I've never been a careerist and neither have my friends. So when Bronson steps back so say we need to fight the urge to justify ourselves by our status, I think "who's 'we'? I never had that urge." I've never had anything to prove to anyone but myself; yet I still feel trapped by some of the life/career decisions I've made.

Now, the book doesn't focus solely on outstanding people. It's just that once I noticed all the med school and law degrees and sold-her-third-startup, I couldn't not notice them anymore, and I'd say to myself "maybe this book isn't for me after all. I'm nothing like these people."

But enough bitching. There's some great stuff in the book as well and some stories really connected with me: the attorney turned trucker; the husband/wife team that bought a tree farm; the would-be Olympic athlete who had to give it up for motherhood; and more. Better yet, some concepts stayed with me. For instance, the this-should-be-obvious concept that local cultures shape expectations and self-worth differently. "In Los Angeles, if you say you're a musician, you're asked ... are you, or will you be, successful? In New Orleans, if you say you're a musician, then people accept that you're a musician, even if you jam one night a week at some dive with no audience." Nice.

My favorite concept from this book is one of Bronson's closing points: the reminder that all you get is a glimmer. The rest is all you and your willingness to to see where that glimmer takes you. I've lived this -- it's true in the creation of good software, it's true in making records, it's true in any creative pursuit. Eureka moments rarely happen, so don't wait around for one.

I found myself flying through this book -- it's written in a nice, casual tone and it's an easy read. But reading quickly was a mistake. I suggest reading a chapter or two at a time, then putting the book down to digest it. Otherwise it's too easy for people and stories to blur together or be forgotten entirely. Maybe that's why the online excerpts were so compelling -- I was left with 2 pages to think about instead of 75.

Okay, so Po Bronson didn't provide the answers to all my problems. But he got me to frame my "what am I doing to do" question better, and he got me to take it seriously. That's worth $15 right there. It's also uplifting to read about people who have found their bliss. There is hope!

I'll lend this book to a lot of friends and I'll probably buy copies for a few as well. It's worth a read.

Whether or not you buy the book, I strongly recommend reading the aforementioned NPR interview and excerpted chapter. Those alone address some great points and will get you thinking.

You can purchase What Should I Do With My Life? from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page. You may also want to visit Po Bronson homepage: pobronson.com."

It's not as racy as F'd Companies , but it is another website that's made the leap to print; this one you could let small children read, and even be happy about it. jenb writes with the review below, only slightly offbeat for Slashdot, of A Word A Day. You may appreciate this link to dictionary.com, too. A Word a Day: A Romp through Some of the Most Unusual and Intriguing Words in English author Anu Garg with Stuti Garg pages 202 publisher Wiley rating 8.5 reviewer Jennifer Buckendorff ISBN 0471230324 summary words, words and more words, broken up by themes into small chapters

For anyone who finds MBA-speak infiltrating daily life (I'll admit to once telling a friend we could "table the discussion for later"), learning new, cool, real words is a good way to spend a rainy afternoon. Anu Garg runs A.Word.A.Day, the website, where, instead of the morning's daily dose of spam, acolytes can receive daily linguistic edification. (The urge to use big words in a review like this is difficult to suppress.) Now he's taken the best of these words and themes and collected them in a slim little volume good for both casual grazing and sit-down-reading.

What's to Like Garg has a logical mind, dividing the book into small chapters with clever themes. There are some humdingers of words, but there are also many surprisingly small entries, as in the chapters "Words that Make the Spell-checker Ineffective" (example: specie, meaning "in kind") and "Words Not to Put on Your Resume" (example: distrait, or absentminded). Anyone who wants to get really meta will like the chapters that are words about words (example: verbigeration, the obsessive repetition of meaningless words and phrases). The truth is, it's just fun to learn new words, stretch the brain a little bit, and to find out how certain etymologies came to be. Pixilated (as opposed to pixelated), meaning whimsical or eccentric, came from the word "pixie," for example, while cremains (from the combining of the words cremate and remains) means exactly what you think. What's to Consider Late in the book, Garg introduces the concept of the malapropism ("the humorous misuse of a word by confusing it with a similar-sounding word"), which seems like an important idea in geek culture. Lots of geeks are autodidacts and readers, and we fall into the habit of mispronouncing or slightly misusing big word. (For years I said prejudice as "pre-justiced" because that was how I thought of the meaning.) To be exact in language -- both in pronunciation and in meaning -- is to have a certain kind of power. It may seem a little prissy to worry about it, but communication is one of those things in daily life that really matter, that people use to make a judgement about how smart or interesting a person is. A weblog filled with all "like, you know" kind of commentary is tedious; a witty one gets forwarded to friends.

As corporate-speak becomes more and more intertwined with technology, it's up to all of us to create a discourse community (a concept a friend from Harvard told me about) that makes conversation sparkly and yet exact, even in the middle of a cube farm. But mostly, it's just fun to think about words and how they could be used. Not that it will ever happen, but maybe at the next meeting, during the next inane bizdev presentation, someone will lean over and whisper "Clearly Manager X must have been decerebrated over the holidays, or he would never have perorated like that this afternoon." And we'll all actually know what he's talking about.

Summary Anu Garg loves words, and the book reflects it. He has a natural curiosity and desire to explain bigger concepts about how language evolves and becomes useful. Playful and humorous in his writing style, he's created a book that other people will want to borrow from you.

You can purchase A Word a Day from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

davorg writes "One of Perl's great strengths is in processing text files. That is, after all, why it became so popular for generating dynamic web pages -- web pages are just text (albeit text that is supposed to follow particular rules). As XML is just another text format, it follows that Perl will be just as good at processing XML documents. It's therefore surprising that using Perl for XML processing hasn't received much attention until recently. That's not saying that there hasn't been work going on in that area -- many of the Perl XML processing modules have long and honourable histories -- it's just that the world outside of the Perl community doesn't seem to have taken much notice of this work. This is all set to change with the publication of this book and O'Reilly's Perl and XML." Read on to see how well Davorg thinks this book introduces XML text processing with Perl to the wider world. XML and Perl author Mark Riehl, Ilya Sterin pages 378 publisher New Rider rating 8 reviewer Davorg ISBN 0735712891 summary Good introduction to processing XML with Perl

XML and Perl is written by two well-known members of the Perl XML community. Both are frequent contributors to the "perl-xml" mailing list, so there's certainly no doubt that they know what they are talking about. Which is always a good thing in a technical book.

The book is made up of five sections. The first section has a couple of chapters which introduce you to the concepts covered in the book. Chapter one introduces you separately to XML and Perl and then chapter two takes a first look at how you can use Perl to process XML. This chapter finishes with two example programs for parsing simple XML documents.

Section two goes into a lot more detail about parsing XML documents with Perl. Chapter three looks at event-driven parsing using XML::Parser and XML::Parser::PerlSAX to demonstrate to build example programs before going to talk in some detail about XML::SAX which is currently the state of the art in event-driven XML parsing in Perl. It also looks at XML::Xerces which is a Perl interface to the Apache Software Foundation's Xerces parser. Chapter four covers tree based XML parsing and presents examples using XML::Simple, XML::Twig, XML::DOM and XML::LibXML. In both of these chapters the pros and cons of each of the modules are discussed in detail so that you can easily decide which solution to use in any given situation.

Section three covers generating XML documents. In chapter five we look at generating XML from text sources using simple print statements and also the modules XML::Writer and XML::Handler::YAWriter. Chapter six looks at taking data from a database and turning that into XML using modules like XML::Generator::DBI and XML::DBMS. Chapter seven looks at miscellaneous other input formats and contains examples using XML::SAXDriver::CSV and XML::SAXDriver::Excel.

Section four covers more advanced topics. Chapter eight is about XML transformations and filtering. This chapter covers using XSLT to transform XML documents. It covers the modules XML::LibXSLT, XML::Sabletron and XML::XPath.

Chapter nine goes into detail about Matt Sergeant's AxKit, the Apache XML Kit which allows you to create a website in XML and automatically deliver it to your visitors in the correct format.

Chapter ten rounds off the book with a look at using Perl to create web services. It looks at the two most common modules for creating web services in Perl - XML::RPC and SOAP::Lite.

Finally, section five contains the appendices which provide more background on the introductions to XML and Perl from chapter one.

There was one small point that I found a little annoying when reading the book: Each example was accompanied with a sample of the XML documents to be processed together with both a DTD and an XML Schema definition for the document. This seemed to me to be overkill. Did we really need both DTDs and XML Schemas for every example. I would have found it less distracting if one (or even both) of these had been moved to an appendix.

That small complaint aside, I found it a useful and interesting book. It will be very useful to Perl programmers (like myself) who will increasingly be expected to process (and provide) data in XML formats.

You can purchase XML and Perl from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

PinglePongle writes "Kent Beck is well known as one of the main drivers behind eXtreme Programming -- a style of development which favours a very disciplined but low-formality approach to coding. Writing applications 'test-first' is one of the practices of XP, and this book explores the subject of test-driven development in detail." Read on for the complete review. Test-Driven Development by Example author Kent Beck pages 220 publisher Addison Wesley rating Superb reviewer PinglePongle ISBN 0321146530 summary Kent Beck -- author of the original Extreme Programming book -- explains in detail how to turn your development world upside down by starting with the test, then writing the code.

What it's all about: Test-driven development is about being able to take tiny little steps forward, test that the step took you in the right direction, and repeat. The "TDD Mantra" is red/green/refactor:

• Red: write a test which will exercise a feature, but which will fail (because you haven't yet written the code)
• Green: make the test succeed, doing whatever you need to do to get to "green" as quickly as possible -- don't worry about prettiness
• Refactor: now that you have code which passes the test, eliminate all the duplication

The book then shows 2 fairly detailed examples of a development project (or snippet of a project) which progress using this style of coding. The first example deals with the creation of multi-currency capabilities for an existing project. In the space of 17 chapters, the author walks you through the creation of 6 classes (1 test class, 5 functional classes), complete with the thought-processes behind them. The code is written in java, and is trivially easy to follow, because it gets introduced in tiny little chunks; most chapters are less than 6 pages in length.

The second example is the creation of a unit testing framework in Python. It is significantly more complex and real-world than the first example, but again proceeds in very small steps, and in small chapters.

The final part of the book contains patterns for test-driven development -- practical real-world advice on how to do this stuff for real. Nearly all the "patterns" are phrased as question/answer pairs, and they range from deeply technical design patterns to advice on the best way to arrange the furniture.

What's good about the book? Kent Beck is a very good writer -- his writing is clear, he is not afraid to leave out stuff he assumes you can guess for yourself, but when he does go into detail you feel it is necessary to get the big picture, rather than mere geek bravado. Even if you don't adopt Test-Driven Development, many of the ideas are well worth considering for your day-to-day coding situations.

What could have been better? The book stresses the importance of taking 'little steps,' and sometimes you feel impatient to move to more challenging tests before properly finishing the current chapter. I was also hoping for more of a discussion on the practicalities of unit testing database-driven systems, where you frequently have to test business entities which are closely coupled to the database.

Summary If you code for a living, or manage people who do, you should read this book -- it's a quick enough read -- and consider some of the assertions it makes. If you feel you're introducing more bugs than you expected, if you feel uneasy about how close your work matches the requirements, this book gives you some powerful ideas. You can purchase Test-Driven Development by Example from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

PHPee writes ""Learn the concepts and build the applications..." - PHP and MySQL Web Development is a well-written web developer's guide to using these open source products to create dynamic websites quickly and easily. This book covers everything you need to design, build and debug your own website from the ground up. Special attention is paid real-world issues, like database normalization and site security. Overall, a great reference for beginner and more advanced programmers alike." Read on for the rest of his review. PHP and MySQL Web Development author Luke Welling & Laura Thomson pages 896 publisher Sams rating 9/10 reviewer PHPee ISBN 0672317842 summary From hello world to e-commerce in under 900 pages...

The authors of the book (Luke Welling and Laura Thomson) do a great job of introducing new programmers to the world of PHP and MySQL. The book is divided into five sections which take the beginner programmer through many lessons in solid, secure web programming.

Part One Starting with the "PHP Crash Course," the reader quickly learns the syntax and language constructs of PHP. The following five chapters focus on topics such as arrays, string manipulation, writing functions and object-oriented PHP. This provides a solid foundation in PHP before moving on to the intricacies of MySQL. This section is very hands-on, using realistic examples, which could be expanded upon as skills progress.

Part Two The following section focuses on MySQL, starting by explaining the advantages of a relational database vs. a flat file storage system. The book assumes no knowledge of databases, explaining simple terms such as tables, columns, rows, etc. It then progresses on to the fun stuff, like designing databases for the web and normalization.

Particular attention is placed on MySQL's privilege system, including proper use of the GRANT/REVOKE commands to give/take away rights for database users. This section is quite detailed and offers a lot more information than I expected. The various column types and associated keywords are also examined in great detail, providing the reader with a solid understanding of MySQL's main features.

Part Three Part Three of the book examines the issues associated with running an e-commerce site. This section is nicely done, looking at common mistakes and how to avoid them. These include things like server security, data backups, keeping detailed logs and dealing with other threats, such as crackers, denial of service attacks and destruction of data. Authentication methods and encryption schemes are also thoroughly covered.

Part Four This section of the book expands on part one, delving into some more advanced PHP techniques, such as interacting with the file system, using network and protocol functions and generating images on the fly with the gd library.

This section also looks at PHP's powerful session functions, including using sessions with authentication and the use of cookies.

Part Five This is by far the most exciting section of the book. Here the reader is presented with seven real-world examples that utilize most of the issues presented throughout the book. These practical projects are presented in an easy to follow manner. The basic problem is presented, and then a solution is proposed. The authors take you from start to finish, outlining the database design, necessary files and functions and show you how to tie it all together. They are also very good at pointing out possible enhancements or alterations, hopefully inspiring the reader to develop their skills and create something beyond the scope of the book.

The seven projects are as follows:

• User authentication and personalization
• Shopping cart
• Content management system
• Web-based email service
• Mailing list manager
• Web forums
• Generating personalized documents in PDF format

Each of the projects has a real-life application, and can easily be modified to fit the needs of almost any website. The shopping cart application is quite complete, and could serve as a basic cart as-is. The web-based email service incorporates the IMAP and POP3 protocols in an easy to understand manner. And the web forums project discusses the complexity involved in creating a threaded discussion board. It even refers to slashdot as a "fantastic example of a popular website that uses discussion boards" :)

Other info: There are a few minor typos and errors in the book, but nothing to get angry at the authors about. Most of them are quite negligible, but may still create some frustration for beginners. (For example, they make reference to a function isempty(), which does not exist in PHP. The real function is simply named empty()...) Small errors like this may create some confusion, but the errata listed on the author's website are quite helpful, yet not all-inclusive.

The appendices do a good job of showing you how to install apache, PHP and MySQL to get up and running under both Linux and Windows. The book also comes with a CD that contains a PDF version of the entire text, all code examples, and copies of PHP and MySQL so you can set up your own development environment at home.

Overall The book is targeted toward intermediate to advanced programmers, but I'd suspect it would be more useful to the beginner to intermediate group. However, the book is organized in a way that accommodates beginners and more advanced users. If you have previous programming experience, you can probably skip some of the early chapters and jump straight into the larger projects. It's a handy reference book, nonetheless. This book covers almost everything you need to know to learn how to use PHP and MySQL to create dynamic, database-driven websites in no time at all. It does an excellent job presenting some real life projects, and the emphasis on security and clean code is consistent throughout the entire book.

You can purchase PHP and MySQL Web Development from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Steve Mushero writes "Alfred Loomis - Lawyer, Wall St. Tycoon, Scientist, Inventor, Catalyst. This biography follows the life and times of Alfred Loomis of Tuxedo Park, NY, a man I'd never heard of. Imagine my surprise to read the book jacket, which described him as one of the most powerful men on Wall Street in the 1920's, a brilliant physicist, inventor of RADAR, LORAN, and the man who kicked off the race to build the atom bomb. While far from a historian, I follow economic and military history with some interest and have never even heard this man's name; which, it turns out, was the way he wanted it." Read more about this obscure but important scientist and entrepreneur in the rest of Steve's review, below. Tuxedo Park: A Wall Street Tycoon and the Secret Palace of Science That Changed the Course of World War II author Jennet Conant pages 330 publisher Simon & Schuster rating 8 reviewer Steve Mushero ISBN 0684872870 summary A biography of one of the greatest scientists and catalysts of our time, helping inventing RADAR and LORAN along with jumpstarting the Manhattan Project.

Loomis, a Harvard lawyer from a well-to-do WASP family, went from practicing law to doing artillery research in WWI to one of the most spectacular accumulations of Wall Street wealth in the go-go 1920's. He personally drove the creation of the electric utility industry and helped form or run most of the major Wall Street banks of the day (nearly all of which are still with us in original or merged form). Smart enough to see the 1929 crash coming, he sold his stocks early and entered the depression worth $50-100 million, all in cash.

How did he use this money ? By retiring to his real love, science and inventing, eventually being elected to the National Academy of Science. A brilliant man, at parties he would often play several games of chess simultaneously, with his back to the boards and while maintaining lively conversation with his other guests. When tackling scientific problems, he generated dozens of ideas to try and had dozens of teams running down these ideas, setting the stage for the Manhattan Project, which pursued all available avenues simultaneously.

During the Depression, Loomis built a huge laboratory in Tuxedo Park, a very wealthy enclave 40 miles northwest of New York City. The first gated community, it was largely populated by the Rockefellers, Morgans, and other rich scions of industry and finance. Considered the premier research establishment of its day, a typical day at the lab featured visits by Fermi, Lawrence, Einstein, Bohr, and scores of others, all helping Loomis work on important problems of the day.

Not content to be an observer, Loomis himself ran many of the experiments and published dozens of papers on a very wide variety of subjects. He would typically solve some major stumbling block in an area such as ultrasonics, microwaves, or biology and then leave others to work out the details.

Called to action in WWII by patriotism and is famous cousin, Henry Stimson, the War Secretary, he personally made RADAR a reality (borrowing heavily from British, who he convinced to give us all they knew), building the MIT Rad Lab from scratch into a war-time R&D lab of 5,000 people.

I had always thought RADAR played a minor role in WWII, but it turns out to have been extremely important, with nearly 25,000 units produced. It was conceived to help stop the German night raids on Britain, but beyond that helped end the U-Boat menace since Loomis' system could detect subs on the surface and even periscopes. Bombing RADARs guided bombers over the Continent and LORAN, which Loomis personally invented, guided all aircraft navigation in Europe, the Atlantic, and Pacific for the second half of the war.

Loomis helped kick off the hunt for the atom bomb more than a year before the Japanese bombed Pearl Harbor, largely via his close friend the brilliant Nobel Laureate Ernest Lawrence at Berkeley (for whom the Lawrence Berkeley and Lawrence Livermore labs are named). While Loomis did not actually work in the atom efforts (he was too busy with RADAR), he mobilized the money, scientists, and political will to make it happen. He foresaw in the 1930's how nuclear fission and Germany's war-mongering would spell bad news for the world.

The book itself paints all of this in very concrete ways, moving back and forth between Loomis' private and public life, including quotes from nearly all involved. The author is related to many players in the story, including some of Loomis' closest friends, and thus had access to personal papers and numerous family members through the ages.

Writing in a witty and sometimes humorous style ("[T]he RADAR scientists knew they needed a single transmit/receive antenna. The trouble was, no one knew how to build one.") the book is an engaging read all the way through. A fair amount of scandal is mentioned, as the book opens with the suicide of one of Loomis' closest friends (the author's great uncle) and moves from there to gradually expose all that was going on through three of the most exciting decades of this century.

The book left me very impressed with Alfred Loomis and motivated to work even harder pursue more advances in technology and science, not to mention finance. I hope none of are called to support a war effort in the manner he did, but there are many discoveries that remain for us all; if we are one-forth as productive as Alfred Loomis, we'll do very well indeed.

You can purchase Tuxedo Park from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

kurtkilgor writes "One of the most frustrating things about many areas of science and engineering today is that we know the basics but don't know how to put them together. We know a great deal about how atoms interact, but we aren't so sure about how to combine them to make a 'big picture' of matter. We understand how an individual computer works, but how to build large informational networks with computers is another thing entirely. We know how people act individually, and yet we can't extrapolate the behavior of entire societies from this. I've long been interested in these types of complexity problems, but not a whole lot of material has been available. In particular, Malcolm Gladwell's book The Tipping Point left me searching for an explanation for the many curiosities that he presents. Is there a mathematical description of tipping points? Is there a way to find out when and why things tip? How does information spread through society?" Kurtkilgor reviews below Albert-László Barabási's Linked: The New Science of Networking, which attempts to answer these questions. Linked: The New Science of Networks author Albert-L�szl� Barab�si pages 229 publisher Perseus Publishing rating 10 reviewer kurtkilgor ISBN 0738206679 summary An introduction to scale-free networks and their broad applications

It turns out that in the past few years, a decent amount of progress has been made on this front, largely thanks to the Internet. The Internet allows scientists to exchange information and speed up research, but more pertinently it is a test subject for these kinds of large-scale interaction problems. Linked: The New Science of Networks presents both the story of how the science has developed, and what it means. Unlike much popular scientific literature, the author himself is an active participant in the field.

The biggest surprise and most important lesson of the book is that the Internet, cellular biology, society, matter, and an incredible array of other seemingly unrelated things all form a particular type of structure called a scale-free network. These types of networks have only been described in detail recently, and their study promises to be as fundamental and rewarding as, for instance, waves or diffusion. The presence of the same structure in many unrelated situations suggests that there is a deep physical or mathematical principle which governs them.

The discovery of this principle is the subject of the first half of the book, which is a sort of detective story that leads from the most primitive concepts of graphs, as pioneered by Euler, to the state of the art. It is very interesting in itself to see how inconsistencies in mathematical models have led people to develop more and more accurate ideas of how such networks function. There is a tiny amount of math in the footnotes available for those who want it, but generally no prior knowledge is required. The author writes with plenty of anecdotes, especially in the beginning starting out with such introductions as this one of Paul Erdos:

"One afternoon in late 1920s Budapest, a seventeen-year-old youth cantered with a weird gait through the streets and stopped in front of an elegant shoe shop that sold custom-made shoes ... After knocking on the store's door-an act that would have seemed just as odd back then as today-he entered, ignoring the saleswoman at the counter, and went up to a fourteen-year-old boy in the back of the shop.

'Give me a four digit number,' he said.

'2,532,' came the wide-eyed boy's reply . . .

'The square of it is 6,441,024,' he continued. 'Sorry, I am getting old and I cannot tell you the cube.'"

For another example of both the writing style and the unusual content, the author humorously describes the discovery of a similarity between Bose-Einstein condensation and economic monopoly:

"Essentially Microsoft takes it all. As a node, it is not just slightly bigger than its next competitor. In the number of its consumers it simply cannot be compared. We all behave like extremely social Bose particles, convenience condensing us into a faceless mass of Windows users. As we purchase new computers and install Windows, we carefully feed and maintain the condensate developed around Microsoft. The operation systems market carries the basic signatures of a network that has undergone Bose-Einstein condensation, displaying clear winner-takes-all behavior."

The rest of the book devotes a chapter to a particular example of a network: epidemics, the Internet, economics, etc. One thing is abundantly clear: the more we know about how these things work, the better we'll be able to curb DDOS attacks, stop disease, and control economic failures. An unlikely example of a scale-free network is the cell. It turns out that the interactions among a cell's proteins can be modeled this way, and if we could only understand it, we would be able to come up with treatments analytically, instead of by trial and error as it is done now.

It seems to me that with a greater understanding of networks, we will be able to finally advance in many fields in which progress is currently stalled. From firefly research to AIDS treatment, this is the Next Big Thing.

You can purchase Linked from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Alex Moskalyuk writes "Philip J. Kaplan's F'd Companies is a compilation of famous and not so well-publicized dot-com flameouts. Most of the companies that are described in the book do not exist today, for some others the domain names are being used for similar businesses, but the original management and business plans are gone. Even though F'd Companies presents several chapters in the table of contents, it's better viewed just as compilation of dot-com mishaps, with about one or two pages dedicated to each company." Read on for more Schadenfreude. F'd Companies author Philip J. Kaplan pages 224 publisher Simon & Schuster rating 8/10 reviewer Alex Moskalyuk ISBN 0743228626 summary Spectacular dot-com flameouts

Everyone who's visited the author's Web site at least once has probably noticed Kaplan's style of writing -- raunchy humor abundantly supplemented with free use of four-letter words, which is then mingled with frequent references to the author's male organ and Internet pr0n industry. Not that the book loses its charm because of it -- F'd Companies would probably make a poor choice for a kid's present, but after getting used to Kaplan's style of writing the obscenities and euphemisms add hilarity to otherwise dry management text. Here's Kaplan's contemplation on the value of domain name Wapit.com (now defunct):

The company had a cool name though. I love to wapit in the morning when I first wake up with my stiffy, wapit in the stall of the men's bathroom at lunchtime, and wapit before I go to sleep.

The book is full of references to defunct companies, and reader can easily skip the chapters if some companies sound more interesting than others. The chapter names are well-chosen and represent the author's style well. "$100 SHOPPING SPREE IF YOU READ THIS CHAPTER" talks about the numerous get-paid-for-browsing-the-Internet companies, the industry that was pioneered by AllAdvantage.com and supported later by numerous copycats. "Portals to nowhere" talks about such huge money-burners as Go.com and QuePasa.com. The chapter for 'miscellaneous' companies that did not fit any other chapter is titled "I've no fucking clue."

If you look for objective analysis, or used to work for some of the companies mentioned in the book, do not buy it if you consider yourself a sensitive person. Kaplan disparaging remarks are what makes this book a worthy read. Here are some of the selected quotes regarding bankrupt dot-coms.

IHarvest.com: "I don't think I've ever seen a more useless company than iHarvest.com. Actually, I am sure of it. Such a waste."

CalendarCentral.com: "Why would an application service provider like CalendarCentral.com, a site that provides shared, online calendars for group scheduling, go out of business? Microsoft Outlook/Exchange you say? [description of business model that never worked follows] Another one assimilated by the Borg... and Microsoft probably didn't even notice."

OnlineChoice.com: "And this one cost investors around $20 million and employed seventy people. Seventy people. This business, this WEBSITE, could have been run by a SCRIPT. Zero employees. Okay, MAYBE a couple of people to broker deals with suppliers."

SwapIt.com: "So let me get this straight: 1) I send them a CD. 2) They give me useless "SwapIt Bucks." 3) They go out of business. 4) I get nothing. Great, sign me up! [...] I believe this is the only dotcom that actually had people SENDING them product and they STILL couldn't stay in business."

Being a Web developer, Kaplan just goes into fits when talking about the high-cost Web site development. He admits that some sites might be more demanding than others, but any 6- or 7- digit number and above, in his opinion, is just plain ridiculous. Talking about Rx.com, Kaplan is blunt: "This company had $350 million to build a fucking website and market it a little. I mean, if they spent $1 million a year, they could have been around for hundred of years without a single sale." In a two-page rant about high-cost developer MarchFirst.com, Kaplan admits: "Anyway, building websites is relatively easy. That's not to say that everyone can do it, nor that anyone would be interested in learning how. [...] Generally, it's not brain surgery (which I'm assuming is kinda tricky). [...] I'm an idiot and even I was able to build a successful small business building websites. Thing is, we didn't charge millions to build a five-minute CGI email form. That's why we're still around." (Kaplan's agency is PK Interactive.)

By now you should get a feel of the book. It's easy to read, and is sometimes just hilarious, as Philip Kaplan has good-quality sarcasm almost in every sentence. The book would be of interest to tech types, especially those who had been involved in dot-com craze. For serious business types it provides valuable lessons on how not to run a new business. Kaplan's book is a valuable addition to the history of the Internet economy.

You can purchase F'd Companies from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

jnazario writes "In Dealers of Lightning, Michael Hiltzik illustrates a remarkable setting where research was leading to commercial products. Not all of it, though -- he is telling the story of Xerox PARC and discusses both technologies that made it to commercial shelves and too many that didn't. This is the central story of the book, told with great joy and creativity as well as skill. I got this book originally because I wanted a good read on the origin of network-based worms. What I got was one of the better books on the subject of the history of the computer industry I have yet found." Read on for more on Dealers of Lightning. Dealers of Lightning: Xerox PARC and the Dawn of the Computer Age author Michael Hiltzik pages 448 publisher Harper Business rating 7.5 reviewer jnazario ISBN 0887309895 summary A worthwhile read for hackers and their managers, alike.

PARC, Xerox's Palo Alto Research Center, was created after Xerox bought the research heavy SDS, (Scientific Data Systems), in the late 1960s. Almost immediately the seeds are being planted for a research arm of Xerox. Great minds are obtained in the process and in the same year the ARPANET becomes functional. The timing couldn't have been better.

What quickly emerges is the story of a large group of people, led by great minds and personalities like Bob Taylor and Charles Thacker. Strong of mind and personality, these are bright, visionary people who know what they want to do and how they will have to go about it. No hesitation, the bigger problems are things like How do you bring the right people together? And once there, what do they need?

Taylor brought together the best and brightest he could find, which is to say he got some of the best minds on the planet.

At every stage of the story, Hiltzik captures the mood, the emotion and the environment. In the early stages, he describes how this wondrous world was hatched out of determination and willpower. Xerox looked on during this early stage, perhaps a bit apprehensively, but also expectantly.

With a lot of freedom to tinker, a strong group of physicists and computer scientists were assembled and began building some of the greatest stuff in the world. By the time the 70s are over, Hiltzik's story is thick with the tension of researchers who design without products in mind and with management which attempts to see the value proposition in everything coming out of PARC.

Hiltzik's tour includes stories of how Ethernet was built, how the first personal computers were created and networked, how WYSIWYG applications emerged, and how so much else was created. He spends a lot of time discussing the invention of the laser printer, originally a dream of an idea by outcast physicist Gary Starkweather. Fighting sneers and doubt all along the way, he persisted and created the laser printer. But management only saw a threat to their core business of toner transfer copiers and the outrageous price of the device. However, they did patent the technology and that one invention alone paid for the entire PARC venture.

Several inventions seem so basic that you have to wonder how a company as apparently adept and bright as Xerox failed to capitalize on. Desktop publishing, which seems like a natural outgrowth of a document-processing company like Xerox, was born at PARC but discarded. Color printing as well was dismantled by Xerox. Other ventures, such as the personal computer and the Smalltalk language, seem obvious as unnatural fits for Xerox.

This is the crux of the book, and why it is such a valuable read for both engineers and management alike. For engineers, it is important to get a feel for how management operates, how they best appreciate ideas as marketable products. The same goes for managers, who often don't appreciate the value of research ideas; in this history, Hiltzik shows how that even when things were on the brink of falling apart for Xerox, management was able to continue its course, hoping the rest of the world would be content to buy only a handful of large-scale copiers.

Ultimately the book's epilogue gets it right, more or less. Xerox didn't fumble their future, though they did fail to understand the value of several of PARC's achievements. This is a hotly debated topic for many who feel that Xerox could have easily demanded hefty sums from Apple, IBM, and Microsoft or simply gone to market first with a mass-market personal computer.

The geek in me loves this book for so many reasons. Hiltzik's book is in the same spirit as The Soul of a New Machine and Fire in the Valley -- it's presented in a really thrilling way. The historian in me loves the modern history of the computer science community, and loves to see how the spirit of PARC has migrated to Apple, SGI, Microsoft, and beyond.

All in all I am very glad I read this book. It's inspirational, interesting, and of course relevant to what I do. A highly recommended book.

You can purchase Dealers of Lightning from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Doug Dante writes "Albert Morris is a detective, but he rarely places his real body in danger. Instead, each day he rises and imprints specialized dittos to do his legwork, review the evidence, meet others, and run errands while he stays home, tends his garden, and keeps his real body in good physical condition." Read more about dittos (and other manifestations of future technology) as portrayed in David Brin's Kiln People; Doug's review of the book continues below. Kiln People author David Brin pages 460 publisher Tom Doherty Associates, LLC rating 7 reviewer Doug Dante ISBN 0765303558 summary Detective Albert Morris tries to solve a murder, unraveling layers of intrigue in a future world where people can make ditto copies of themselves.

But after a brief prelude (reminiscent of the introductory scene of Indiana Jones), on the first full day of Kiln People Morris and his dittos are pulled by players in a great game seeking to use him to their own ends. He is hired by Ritu Maharal when her father Yosil Maharal dies in an unexpected and rare car accident. Yosil Maharal and his partner Vic Kaolin founded the corporate giant UK (Universal Kilns) after pioneering soulistics and inventing dittotech years earlier; changing the world forever.

We are introduced to a cast of characters through the first person narration of Albert and his dittos, each of whom, like the blind men touching an elephant in the Indian fable, sees a different picture of events. Albert is the heart of the book, and we understand his motivations and how his physical manifestation, as ditto or person, affects his outlook, attitude, and actions. However, the motivations of other characters including Yosil Maharal, his partner Vic Kaolin, his daughter Ritu, and Albert's mysterious nemesis the dittotech pirate Beta remain cloaked -- disappointingly so as the book closes with some, but not all, of our questions probably, but not certainly, answered in speculative form.

Kiln People is a bit long. Through the first half, as Albert and his ditto selves picked up the trails of their inevitably converging cases, the shadowy figures of Vic Kaolin and Yosil Maharal were mixed in with a cast of other minor characters including Pal, Carla, Gineen Wammaker, the Maestra, and Queen Irene. I had to flip back at least once to recall which one was actually supposed to be dead!

There's a lot of action here. The book features bar fights, urban gun battles, guerrilla surveillance insertions, sabotage, and plenty of danger for the characters. (It could make a good movie with the right script and director). But the characters involved in many of these harrowing situations are themselves dittos, and like the citizens of the Kiln People world, I became desensitized to violence against all dittos, and disinterested in the plight of the characters.

Through the second half, perhaps because of previous experience reading David Brin's previous book Earth, certain future events became rather apparent, and I did find myself eventually wading through the last 100 pages or so just so that I could get through to the foreseeable climax.

That said, Kiln People tied neatly some nagging mysteries as it closed. The book gives a realistic portrayal of a world which had integrated the disruptive technology of ditto tech, and it succeeded in presenting some interesting scientific and speculative material too.

This book shared many themes with David Brin's previous book Earth including the attempted/accidental creation of a deity, people seeking to be Godlike, the threat of mass human destruction, a lone mad genius, and the unity of all humanity within a greater entity. Also, this world, like the world of Earth featured the end of secrecy the dangers of technology, and a semi-libertarian legal system ( Called "the Big Deregulation" here). However, the setting, story and ideas of Kiln People, while reminiscent of Earth, are substantially independent.

If you enjoyed Earth, you will probably also enjoy Kiln People as I did. It's a fair story wrapping interesting ideas in a realistic but fantastic setting. However, it can be a bit long and obtuse.

You can purchase Kiln People from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Ben Olmstead writes with the review below of Henry S. Warren's Hacker's Delight, which is not about tricking folks into providing sensitive information, but rather about how to cleverly manipulate computers into doing more work on their part with less work on yours. Read on for his brief review. Hacker's Delight author Henry S. Warren Jr. pages 320 publisher Addison Wesley Professional rating Excellent reviewer Ben Olmstead ISBN 0201914654 summary Collected Tips & Tricks for Programmers

Hacker's Delight is an impressive compendium of clever tricks for programmers. Warren concentrates on micro-optimizations -- few of the tricks in this book operate on more than 3 or 4 words of memory -- and he displays an impressive knowledge of diverse computer systems in the process.

Who Should Read This Book

Hacker's Delight is hardcore in its presentation and subject matter. I would not recommend this for a beginning programmer -- to fully understand the material requires at least some knowledge of concepts such as Assembly and Machine languages. However, anyone who writes performance-critical software should read this book, even if they do not plan to write Assembly code, both to learn the tricks given, and to learn the concepts behind them.

What's Good

The book is organized into chapters where Warren presents related tricks. In each chapter, he presents a few tricks which perform related tasks -- for example, in Chapter 3, he presents tricks for rounding (up or down) to the next power of 2, rounding to a multiple of a known power of 2, and detecting power-of-2 boundary crossings (i.e., checking for page faults). For each trick, he discusses why it works, whether the technique is generally applicable, related tricks which might be better in specific situations, and where a trick might be used in the real world.

Warren keeps his discussion architecture-neutral, while noting optimizations and problems for specific architectures for specific tricks -- in the process, he displays a vast array of knowledge about specific processors, from 1960's mainframes to x86, MIPS, PPC, Alpha, and others. He also skims the surface of hardware-design issues in a few places -- for example, he devotes a page or two to explaining why computers use base 2 for arithmetic, and why this is the most efficient choice.

What's Bad

This is an extremely dense book, and there are sections which are difficult to understand. Furthermore, there are many tricks which, while interesting, would be difficult to apply to real-world applications, and use of these tricks does violate the Keep It Simple, Clock Cycles Are Cheap And Someone May Have To Understand Your Code philosophy which is harped upon so heavily (not without reason) in modern software design. However, someone writing a compiler or high-performance code may feel that the benefit outweighs the potential risk.

The Summary

If you want a better understanding of the hardware on which your code runs, or you need to squeeze clock cycles, or you just enjoy seeing clever tricks, this is an excellent book. If you primarily use high-level languages such as VB, perl, python, etc., this may not be the right book for you. Be prepared for very dense material.

You can purchase Hacker's Delight from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

benjiboo writes "From the back page: 'Are you looking for a concise book packed with insight and wisdom not found elsewhere? Do you want to gain a deeper understanding of the Java programming language? Do you want to write code that is clear, correct and reusable?' I did, so I bought the book and decided to use it for my first review :)" Read on for bejiboo's review of Effective Java. Effective Java Programming Language Guide author Joshua Bloch pages 252 publisher Addison Wesley rating 8/10 reviewer Ben ISBN 0201310058 summary 57 pieces of Java wisdom.

Introduction

Effective Java is a book very much in the style of Scott Myers' earlier C++ "Effective" series. The book contains 57 individual snippets of Java wisdom, broadly categorised into 10 sections including Classes and Interfaces, Exceptions, Threads and Serialisation. Scott Myers' books are classics; I was interested to see how this would compare.

The author, Joshua Bloch, has been involved in writing many industrial-strength Java libraries. His background is very much evident, in this, his first text. He consistently demonstrates the virtues of favouring libraries, clean APIs and advance design. I found the author very readable, and able to make a convincing argument, even in his more 'controversial' pieces. As with Scott Myers' books, there is a real-world, rather than purist approach taken to the language, with most of the code examples having a real-world feel to them. This is a breath of fresh air when lots of programming books tend to use more contrived examples.

The items

The author has endeavoured to keep the book accessible to less-experienced programmers throughout, while providing food for thought for the more advanced reader. For the most part this is succesful, but a small percentage of articles tend toward the simple side. Examples include 'Minimise the accessibility of classes and embers,' 'Write doc comments for all exposed API elements,' and 'Know and use the libraries.' We've all heard this advice many times and I don't feel that these add value. The vast majority however, are pitched at the right difficulty level. The selection of items is well balanced and broad, although unfortunately there are none pertinent to GUI programming.

Many of the articles are fundamentally based on known design patterns and idioms. Although a useful index to these patterns is included, I would have liked to see the virtues of design patterns summarised and demonstrated to a greater extent, perhaps in the introduction.

I was highly impressed with all code examples. Where used, they are consistently short, relevant and concise, with more verbose examples included on the website. The chosen code examples only ever assist in explaining complex concepts clearly.

The strongest area of the book for me was the section on threading. The author clearly demonstrates, for instance, how overuse of synchronised methods can lead to deadlock. He also provides food for thought on how the thread scheduler might trip us up. A section on moving from C constructs, which initially struck me as an odd category, proved very interesting and thorough. 'Replace enum constructs with classes' is a particularly interesting item, demonstrating the fragility of C enums, and indicating why the often-used replacement in Java (a bunch of public static constants) suffers from the same failings.

In conclusion

Ideally I would have liked to see some of the thinner items removed, and perhaps replaced with a section on the GUI libraries. I also liked the short prose sections, and thought the author could have spent more time setting out his stall before launching in to the items. Having said this, this is one of those rare books which could help a good programmer become an excellent one. Many of the books currently out there are aimed at either the beginner or the guru, and this book fills a gap.

I find this style of book very useful, in that I could foresee meeting the vast majority of the described situations at some point or another. So long as you aren't looking for tips to help you with your GUIs, this title is more than worth the investment.

For anyone interested, those sections in full:

• creating and destroying objects
• methods common to all objects
• classes and interfaces
• substitutes for C constructs
• methods
• general programming
• exceptions
• threads
• serialisation

You can purchase Effective Java from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

MasterSLATE writes "One of the weakest links to the most secured computer systems are the humans that operate them. No matter how well secured a computer, network or information may be, there are always people that will have contact with them from the inside. This is what the social engineer exploits in order to gain access. In The Art of Deception, Kevin Mitnick writes about the human element and how it can be manipulated and exploited to gain access to computer systems or 'secure' information." Read on for the rest of Masterslate's review. The Art of Deception author Kevin Mitnick (& William L. Simon) pages 346 publisher Wiley Publishing, Inc. rating 9 reviewer MasterSLATE ISBN 0471237124 summary Geared toward the company security guy, but a good read for anyone interested in security, especially social engineering What's to Like?

The Art of Deception is extremely easy to understand and actually fun to read.

The first part of the book, Behind the Scenes contains the first chapter, Security's Weakest Link, which describes through many examples how and why the social engineer is able to so easily manipulate people to get what he wants.

Part 2, The Art of the Attacker, contains chapters 2-9, which describe various ways a social engineer can manipulate people over the phone. Each chapter tells of a different method that could be used to gain information. Each chapter also contains at least one example.

Part 3, Intruder Alert, contains chapters 10-14, which tell about different ways a social engineer can get inside a company, whether physically or through an internal contact. Each chapter contains at least one example.

Part 4, Raising the Bar, contains chapters 15 and 16, which explain how a company should create their security policies and training to prevent the social engineer from gaining access to sensitive information. These chapters are definitely more geared toward the executive, security analyst, or other specialist, as they contain specifics on what new policies should be implemented and why.

The last section in the book, Security at a Glance, contains some charts and information which should be read over by a more general audience, such as employees and other people that may be contacted by a social engineer.

And one sidenote: there's a nice little foreword by Woz (Steve Wozniak).

The Summary Although this book is geared toward the company security expert, this book also has appeal to anyone with an interest in social engineering. I found it to be a quick and fun read. As a social engineer, this book taught me new tactics to try as well as ways that my targets might be prevented from giving me information I seek.

Table of Contents

Foreword
Preface
Introduction

Part 1 Behind the Scenes
* Chapter 1 Security's Weakest Link
Part 2 The Art of the Attacker
* Chapter 2 When Innocuous Information Isn't
* Chapter 3 The Direct Attack: Just Asking for It
* Chapter 4 Building Trust
* Chapter 5 "Let Me Help You"
* Chapter 6 "Can You Help Me?"
* Chapter 7 Phony Sites and Dangerous Attachments
* Chapter 8 Using Sympathy, Guilt and Intimidation
* Chapter 9 The Reverse Sting
Part 3 Intruder Alert
* Chapter 10 Entering the Premises
* Chapter 11 Combining Technology and Social Engineering
* Chapter 12 Attacks on the Entry-Level Employee
* Chapter 13 Clever Cons
* Chapter 14 Industrial Espionage
Part 4 Raising the Bar
* Chapter 15 Information Security Awareness and Training
* Chapter 16 Recommended Corporate Information Security Policies

Security at a Glance
Sources
Acknowledgments
Index

You can purchase The Art of Deception from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

john writes "What I'm looking for is a detailed users' manual for a Baloney Detection Kit (as Carl Sagan called it.) I'd hoped to find this in one of Shermer's previous works, Why People Believe Weird Things, and I'd hoped to find it here. In both cases, the first part of the book did exactly this, but somewhere along the way it turned into case studies of debunking, rather than the process of debunking. (That's okay: they're well-written.)" Read on for john's review of The Borderlands of Science. The Borderlands Of Science: Where Sense Meets Nonsense author Michael Shermer pages 360 publisher Oxford University Press rating 7 reviewer john ISBN 0195157982 summary Explaining belief in things that seem silly.

Michael Shermer's background is psychology and ultra-long-distance cycling; he's written a number of books on cycling and analysis of (and refutation of) Holocaust deniers. He's also president (apparently for life) of the American Skeptics society and a reasonably good writer. In this book, Shermer spends a lot of time talking about the scientific method, its strengths and potential flaws -- and, more importantly, its system for dealing with its flaws (which he claims "sets science apart from all other knowledge systems and intellectual disciplines" -- a heady claim I wish he discussed more).

Since this is supposed to be a review of The Borderlands Of Science and not Weird Things, I'll just say that if you like one, you'll like the other as well. In Borderlands, Shermer analyzes beliefs that are defensible, beliefs that could (or were once thought to) be scientifically accurate. Among these are, for instance, ramifications of cloning, confirmation bias in explaining racial differences in sports (about which Malcolm Gladwell has also written), and a whole, whole lot of discussion of Alfred Wallace. Wallace and Charles Darwin were both responsible for the theory of evolution. Wallace is not remembered as widely for a number of reasons, which are explored in frightening detail in roughly three and a half of the 16 chapters of this book. Not coincidentally, Shermer did his doctoral thesis on Wallace. The ratio of stuff-about-Wallace-or-Evolution to everything-else, by chapter, is 3:7; Shermer is pretty focussed on this specific discussion.

The book has four sections: a short introduction (which is quite heavy in skeptical theory, exactly what I wanted) and the main body, discussing borderlands theories, people, and history. In "Theories," Shermer tends to stray a little from 'why people believe weird things' into 'why stupid people believe weird things' (as he did in the book of the same title) and that's fun. He covers a lot of quite current topics (like cloning, Wacky Unified Field Theories, and the importance of Punctured Equilibrium in the evolution of evolutionary theory).

In section two, "People," he discusses the Copernican revolution and its effects, then goes off about Alfred Wallace. Here, he does something weird that needs more discussion. In analyzing Wallace, he constructs a psychological profile, which he derived by having a large number of Wallace experts fill out a survey of the "strongly agree, 9, 8,.. 3, 2, strongly disagree" sort, and then uses the results of these surveys to fill in his discussion of why Wallace became a scientific spiritualist, for instance. It's an interesting technique that he also uses with Steven Jay Gould and Carl Sagan. It is tempting to ask how much confirmation bias exists in a survey of this sort, though. Since I've already let the spoiler out of the bag, Shermer discusses Gould and Sagan, spends some time doing a statistical analysis of Sagan's greatness as a scientist (by comparing published papers by topic with a number of other contemporary, canonically great scientists) and pauses briefly to smack Freud upside the head in a somewhat snarky comparison of Freud and Darwin.

Finally, in section three, "Histories," he does a lovely discussion of the myth of pastoral tranquillity, including a quick summary of four ancient civilizations that probably managed to destroy themselves through environmental stupidity without (as he puts it) any need of Dead White European Males coming in and inflicting devastation from outside. Shermer then analyzes (and debunks) the theory of transcendent genius, the Mozart Myth, as he calls it, and goes back to two more chapters on Wallace and evolution, in a discussion of the Piltdown Man hoax and why that should have (but doesn't seem to have) supported the idea that science can be self-correcting and learn from its mistakes.

I like what Shermer is doing, and he writes well and readably. If I sound a bit impatient, it's because I want him to be writing about the application of critical thinking rather than case studies, and when he starts out writing just what I want to read, then goes off in a different direction, he leaves me standing at the intersection saying "hey, wait, this isn't the bus I wanted." The book could stand to be either edited down into two books (a Wallace analysis, and a case-studies book on how science inspects itself), or edited up with a clearer discussion of the math involved in his statistical analysis of Sagan or his psychological profiling of people.

In the end, I liked this book, I learned a fair bit from it, and I would recommend it to people who want to learn more about both critical thinking and science history.

You can purchase The Borderlands of Science from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Andy Murren submits this review of Nick Christenson's Sendmail Performance Tuning, writing "The first thing that I noticed about this book was how relatively thin it is at only 223 pages. This is compared to the O'Reilly Sendmail book by Bryan Costales and Eric Allman (a.k.a. the 'Bat Book') which weights in at 1232 pages. In this case, thin is good. The second thing that I noticed about the book is the quote from Eric Allman emblazoned across the top that proclaims 'This book is great.' That's rather ringing endorsement from the original creator of sendmail. But great what? A great technical reference? Companion to the bat book? Kindling? Now here is my sound bite about this book: 'One damned fine technical book.'" Read on for the rest of Andy's review. Sendmail Performance Tuning author Nick Christenson pages 256 publisher Addison Wesley rating 9 reviewer Andy Murren ISBN 0321115708 summary Compact but well-constructed book; shows you ways to cost-effectively improve your sendmail setup, and much of the rest of your system along the way.

This book was very easy to read and kept moving along. While I did not find it as much of a page turner as Douglas Adams' Hitchhikers Guide, it did keep me interested. One word of warning though: do not read this when you are tired. You will miss some really good information and have to re-read parts.

I was surprised and very pleased with how much I learned about so many things about Unix, networking and hardware while learning more about sendmail. There is a wide range of information presented that readers at almost any skill level would be able to use. The writing style and use of language was easy to read. The wealth of information packed into the pages of this book I found immediately usable on my Linux boxes and for my job.

I think the only drawback to the book was that there was not more specific sendmail information. Due to the nature of the topic, a lot of the book is devoted to how Unix systems work, more than specific sendmail configuration tasks. Time and detail is spent on other more important considerations such as logging, disk performance, test planning and file systems.

Chapter 1 gets us started with an overview of tuning in general. One of the more important themes of the book is established up front: It is that a cost/benefits analysis should be done for each step.

Sections 1.5, "Tuning Isn't Always Necessary" and 1.6, "Not So Fast ..." establish baseline considerations for making a decision on what, if any, tuning efforts should be made. Throughout the book Christenson reminds the reader to decide on a path that is most cost effective for his organization. Is it the most cost-effective use of the company money and time to have the IT staff hand-craft solutions, or is it better to throw some hardware at the problem?

Let's face it -- if you are running sendmail for a small company and only move a few hundred emails a week, how much performance tuning do you need? If, however, you are running an ISP, a mailing list server or a medium- (or even a large-) sized company mail server, then you need to tune your mail server. This is the book for you. The information in this book, while oriented for sendmail, is actually applicable for tuning any Unix based Mail Transport Agent (MTA) server.

Each solution is an individual matter, that is wholly dependent on several factors. Some of these factors are: volume of email, what the main use of the email system is, how the end users interact with the system, what hardware is being used, how much bandwidth you have and much time and money you have to throw at the problem. Of course, what management considers important is the overriding factor in all decisions.

Chapter 2 is a ten-page introductory overview to sendmail, covering versions, obtaining the (Open Source) code and building sendmail. One of the important things covered is the queue and message spool layouts and permissions. This is helpful for making sense of things later in the book.

A few very important pages are spent on creating the .cf file and why you should use M4, the macro language, for managing the configuration files. Having hand-crafted a .cf file myself several years ago then having to deal with maintaining it, I can vouch for the wisdom of using M4.

The maintainers of sendmail update the M4 macros for new features and changes. The 200 - 300 lines of M4 macro files are converted into a 1500to 2000 line configuration file. While it may be easier to figure out the configuration file to make changes, those changes may not be valid from one version of sendmail to the next.

Christenson admits that he does not always use M4 when in a rush or to test some things. What he does is copy the working configuration file to sendmail.cf.REAL before making changes and updating the .mc file afterward.

The next chapter, Chapter 3 'Tuning Email Relaying' starts with an overview of the email relaying sequence. Most of the discussion in this chapter is not sendmail specific. The importance of data synchronization is emphasized here. Section 6.1 of RFC 2821 is quoted, where it states the email server 'MUST NOT lose the message'. Once that is stated and understood all of the requirements that are discussed in the rest of the chapter are clear.

The next 17 pages are spent discussing how file systems, networking and effective use of file space support, and can detract from, meeting the edict of the RFC. For me, these sections are some of the most interesting, filled with information presented in a concise, readable and detailed manner. I learned a lot about what impact some very basic decisions have on email performance. I also learned how much better I could have made the email servers I have worked on. I will be turning to this chapter the next time I am putting together a box, be it a web server, mail server, file server or even a workstation or laptop. This is a great chapter that can help with any system configuration.

Email reception is covered in chapter 4. Different strategies for verifying recipient, tuning POP and IMAP are covered. Effective use of Local Delivery Agents (LDAs), including procmail, is covered here also.

Additionally, an excellent discussion of storage systems, including disks and solid-state disks, is in this chapter. The sections covering RAID levels, benchmarking and use are well written and informative. Available options on drives, ATA vs. SCSI, Solid State, are just as well done. Section 4.4.2, 'Stupid Disk Drive Tricks,' has some nifty information about how to set up disk drives for even better performance.

Sending email is the next chapter. Here we see some more sendmail-specific information. Tuning of mailing lists and mass mailing is part of the discussion here. One of the more important sections is 'Draining Queues.' How backups are caused and what to do to recover are discussed in this section. This has good information that can be used with any MTA.

One of the most important chapters for me is Chapter 6 'Configuration, Security and Architecture.' Sendmail specific configuration and tuning options are discussed. Section 6.1 covers configuration and is in many ways the heart of the book. This is where sendmail directives that can directly impact performance are covered. How a system's architecture (and DNS) is laid out can have a significant impact on performance.

The section on security is good, but brief. Most of the discussion is on privacy and stopping spam. The use of Transport Layer Security (TLS) is covered in less than a page. With a smattering of security in other parts of the book, this is the sum total of the security discussion of the book. Considering some of the problems with sendmail in the past, I would have liked some more information on this topic.

The next two chapters, 'Finding and Removing Bottlenecks' and 'Load Generation and Testing,' are good, solid, well-written sections that are applicable to most any email system. We are given some effective ways of making systems run better, and how to prove that the system actually does work better. This is where we justify to the boss that the work we have done is really cost effective.

Chapter 9, 'Conclusion' is basically a very brief wrap up and a list of books Christenson thinks we should read.

My own conclusion is that I have learned and relearned a lot of things about Unix and email. Even if you do not use sendmail, I recommend this book without reservation. It is an excellent reference on general system performance tuning, with information on making your sendmail installation run better.

Table of contents

1. Introduction
   • 1.1 Performance Tuning Examples
   • 1.2 sendmail Versions Covered
   • 1.3 Definitions
   • 1.4 Email Server Tasks
   • 1.5 Tuning Isn't Always Necessary
   • 1.6 Not So Fast...
   • 1.7 Email System Profiling
   • 1.8 General Tuning Ideas
   • 1.9 Summary
2. Sendmail Introduction
   • 2.1 Obtaining Sendmail
   • 2.2 Building Sendmail
   • 2.3 Creating a .cf file
   • 2.4 Why Use M4?
   • 2.5 System Setup
   • 2.6 Summary
3. Tuning Email Relaying
   • 3.1 What Happens During Relaying
   • 3.2 Synchronization
   • 3.3 File Systems
   • 3.4 File Space
   • 3.5 Networking
   • 3.6 Summary
4. Tuning Email Reception
   • 4.1 What Happens During Email Reception
   • 4.2 Recipient Verification
   • 4.3 Storage Systems
   • 4.4 Disks
   • 4.5 Solid State Disks
   • 4.6 POP Tuning Specifics
   • 4.7 Message Storage Hashing
   • 4.8 IMAP Tuning Specifics
   • 4.9 Summary
5. Tuning Email Sending
   • 5.1 Mailing Lists
   • 5.2 Command-Line Message Generation
   • 5.3 Draining Queues
   • 5.4 Another Mailing List Strategy
   • 5.5 SMTP PIPELINING
   • 5.6 More Notes on Mass Mailing
   • 5.7 Summary
6. Configuration, Security and Architecture
   • 6.1 Configuration
   • 6.2 Security and Performance
   • 6.3 Other General Strategies
   • 6.4 Summary
7. Finding and Removing Bottlenecks
   • 7.1 Kernel Parameters Run Amok
   • 7.2 The Quick Fix
   • 7.3 Tools
   • 7.4 syslog
   • 7.5 Removing Bottlenecks
   • 7.6 Summary
8. Load Generation and Testing
   • 8.1 Test System Setup
   • 8.2 Testing Tools
   • 8.3 Load Testing Pitfalls
   • 8.4 Summary
9. Conclusion

You can purchase Sendmail Performance Tuning from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

David Schaffter writes "I bought Hacking Linux Exposed when it first came out. What struck me about it at the time was that it was unlike the other hacking books that were out there. Most seemed to play on the hacker craze, and were essentially lists of cracks. Hacking Exposed, presumably the model for HLE, was very much like this. Topical, overblown, and in the end it was outdated by the time you got it." Read on to see what David finds has changed (or not) in the second edition. Hacking Linux Exposed, Second Edition author Brian Hatch, James Lee pages 720 publisher Osborne McGraw-Hill rating 10 reviewer David Schaffter ISBN 0072225645 summary This second edition of the best selling Hacking Linux Exposed shows you in great detail how to secure your Linux box - or break into one.

HLE on the other hand was much more like a good textbook -- it taught you how to think about security, to see how each problem was caused and how to combat them. As the years went by, my copy of HLE was still as useful as it was the day I got it. For this reason, I was skeptical what they could put into a second edition -- the first seemed to stand the passage of time just fine.

Nonetheless, I bought it, and was surprised to find that the second edition is even stronger than the first, yet they have made it still work on its own -- you don't need to buy the first edition to have a complete understanding of Linux security. You should probably read their reviews page which has links to reviews of the original, as well as the Slashdot review from last time which have detailed breakdowns of what you'll find. I'll concentrate on the changes in this review.

The new edition deprecates or cuts a lot of old material that is no longer applicable -- the emphasis is on OpenSSH configuration vulnerabilities, rather than RLogin/RSH/etc, for example, which is fine since no Linux system comes with Rlogin installed by default any more. The second edition is 100 actual pages longer, but due to the condensing of old material, it's effectively 200 pages longer at least. They took out some of the material that isn't needed in the paper copy and put it online too, which was a great idea.

So, from my perspective, here are the noticeable differences:

• More tools are covered in detail -- Exim gets equal play with Sendmail and friends, DJBDNS gets covered as much as BIND. (For configuration, that is. Nothing can match BIND for vulnerabilities.)

• There's a whole new Denial and Distributed Denial of Service chapter, that covers the gamut - much more than just your simple TCP-connect floods.

• There are three new chapters about post-system-compromise tricks the crackers will play on you, showing you exactly what kind of things you'll need to clean up if they get in. This stuff was absolutely amazing, and the authors could probably write a whole book on this if they wanted to.

• More distribution-specific information.

• Step-by-step instructions on how to patch and rebuild your kernel using the existing kernel configuration parameters, detailed enough that any newbie could do it. They have specific variants for Red Hat and Debian as well.

• The best discussion of network-based attacks (ARP spoofing, Man-in-the-middle, session hijacking, etc) in any book, anywhere. You could easily use the stuff in this chapter to take over Windows machines too.

• More custom tools and code than before.

• Just passing references to things like the Morris worm, the Ping of death, ipfwadm, and other hacks and tools that are so old and irrelevant today that they shouldn't be discussed in depth any more. They get their nod, but the authors spend quality time with things of current relevance only, rather than wasting the space just to make the book look thick.

• Even more integration with the website.

That last one needs a bit of explanation. Brian Hatch, the lead author of HLE, has a weekly security newsletter called Linux Security: Tips, Tricks, and Hackery. (You can read the article archives or subscribe.) These often have very detailed implementation instructions, such as installing DJBDNS and migrating away from BIND, using /proc to investigate cracker activities, and occasionally has contests too.

The nice thing is that Hatch has built up a body of free online instructions, and thus rather than copy and pasting them into HLE, he can point to the online articles from within the book. This saves lots of paper, and keeps you focused on the goal of the book -- to learn attack methodologies and how to stop them.

One thing that these guys prove in their book is that "code is speech." Rather than having wordy passages such as "The user then needs to run the command 'nc client-ip-address 80' on server 'freddie' from the /etc/ directory where client-ip-address is the actual ip address of the target, and type ..." they show it all through a command-line view, embedding this extra location and user information in the prompts and formatting (bold/italics/etc) like this

jdoe@freddie:/etc$ nc client_ip 80
GET /some/web/page
<head><title>This is some web page</title>
...

They always show you what's actually going on behind the scenes -- an actual SMTP or POP conversation for example -- so you know how things really work, rather than living in a black box where Nessus says "vulnerable" and you don't know how to determine it on your own.

Here's a very quick table of contents:

• Part I: Linux Security Overview
  • Chapter 1 -- Linux Security Overview
  • Chapter 2 -- Proactive Security Measures
  • Chapter 3 -- Mapping Your Machine and Network

• Part II: Breaking In from the Outside
  • Chapter 4 -- Social Engineering, Trojans, and Other Cracker Trickery
  • Chapter 5 -- Physical Attacks
  • Chapter 6 -- Attacking over the Network
  • Chapter 7 -- Advanced Network Attacks

• Part III: Local User Attacks
  • Chapter 8 -- Elevating User Privileges
  • Chapter 9 -- Linux Authentication

• Part IV: Server Issues
  • Chapter 10 -- Mail Security
  • Chapter 11 -- File Transfer Protocol Security
  • Chapter 12 -- Web Servers and Dynamic Content
  • Chapter 13 -- Access Control and Firewalls
  • Chapter 14 -- Denial of Service Attacks

• Part V: After a Break-In
  • Chapter 15 -- Covert Access
  • Chapter 16 -- Back Doors
  • Chapter 17 -- Advanced System Abuse

• Part VI: Appendixes
  • Appendix A -- Discovering and Recovering from an Attack
  • Appendix B -- Keeping Your Programs Current
  • Appendix C -- Turning Off Unneeded Software
  • Appendix D -- Case Studies

The HackingLinuxExposed.com website has a more complete list of contents, as well as a sample chapter.

The other nice thing is the authors have put all their source code, tools, and example cracks online for free download, released under the GPL. You may notice that you need to type a password to get in, but if you have half a hacking cell in your body, you'll find that the authors think a password requirement is stupid as we do.

If I could change one thing about this book, it would be the risk ratings. These are the dumbest things I've seen. These are little boxes at the beginning of each 'Attack' that list three values: "Popularity", "Simplicity" and "Impact." It then averages these and comes up with a risk rating. Since all the Hacking Exposed books have them, I can only assume it was a requirement of the publisher -- I don't know if Hatch and Lee care for them one bit, but I can tell you I find them useless. (Of course, I give this book a 10 in spite of this fact.)

These numbers are presented as quantitative, but it can't possibly be. I can argue giving many different values in each category, so what does this actually tell us? For example take open X11 servers. Impact could be 10 because you could type a root password that's intercepted, or it could be 7 because it only gives you user-level access. Popularity could be 3 if you say most people don't set it up this way, or you could say it's 9 because many crackers look for open servers. I'd rather they just used impact, gave it a scale of 1-10 and were done with it. The popularity and simplicity factors override the impact in too many cases to make the final value anything but specious.

Aside from that drawback, which is easily ignored, the book is absolutely solid.

When I was about to buy my copy, I noticed that the authors are donating all online proceeds to the Electronic Frontier Foundation, so you should order through their website, regardless what the Slashdot link may be. ;-)

In my opinion, there's no Linux user who should be without this book. It's 720 pages of answers you need to keep yourself secure from the blackhats, or 720 pages of ways to become a blackhat yourself, depending on your ethical alignment. Either way, you won't be able to put it down, except to type as you follow along.

If David did not convince you otherwise, you can purchase Hacking Linux Exposed, Second Edition from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Were you the eccentric cousin with a chemistry set? Peter Kukla contributes the review below of Oliver Sack's Uncle Tungsten, which sounds like a fun read about growing up curious about chemicals. (Don't worry -- the book sneaks in lots of information about the periodic table and its contents, besides.) For certain families, the science-centric childhood Sacks describes may seem perfectly ordinary. For others, it may give a glimpse into what your kids could learn, given some curiosity and the right environment. Uncle Tungsten: Memories of a Chemical Boyhood author Oliver Sacks pages 320 publisher Vintage Books rating 8 reviewer Peter Kukla ISBN 0375704043 summary Interesting history of the author's childhood, and of chemistry in general.

Oliver Sacks is a noted neurologist, and author of a number of books for popular audiences, including The Man Who Mistook his Wife for a Hat. I came across Uncle Tungsten: Memories of a Chemical Boyhood while browsing through a bookstore a few months ago, and decided to give it a read.

Uncle Tungsten is billed as "Memories of a Chemical Boyhood" in the title, but it's actually far more than a simple biography of his childhood. The real focus of the book is trifold: the influence of chemistry upon his early life and his early chemistry experiments and researches into chemistry, the stories behind the discoveries of the elements comprising the periodic table and of the discovery of the periodic table itself, and the non-chemical aspects of his childhood.

We learn early on that Sacks' family was chock-full of chemists (the title of the book refers to an uncle whose factory produced light bulbs using tungsten filaments), physicists, and doctors (including both of his parents). As a result, he had access to volumes of information about chemistry and access to chemicals of every sort, not to mention a family that was quite happy to indulge his interests. He made good use of these resources, ultimately gaining his own chemistry lab at home (complete with fume cupboard) where he experimented with a little of everything in an attempt to find out as much as possible about the chemical world.

His stories about how various elements had been isolated are given color by his own experiences with these same elements as a child. When he reaches the radioactive elements, for example, he illustrates some of the properties of uranium by describing his experiments with a chunk of uranium ore given to him by one of his uncles! Other experiments include dropping sodium (which is highly reactive with water) into a pond in a nearby park to watch it burn, bleaching red roses by holding them over burning sulphur, and using a spectroscope to examine the absorption Sacks' childhood experiments, however, are only part of the picture. Tales of his childhood are frequently interrupted by stories about the pioneers of chemistry (such as the Curies, Mendeleev, and Humphry Davy) who identified and isolated the various elements. As he discusses the discoveries of the elements, he includes descriptions of those researchers who ferreted out these elements, the puzzles they encountered during their work, and the hazards they faced when working with dangerous substances.

The book does include "non-chemical memories," too. Although chemistry was his first love, Sacks got the opportunity (and, with physician parents, the encouragement) to dissect worms, octopi, and even human cadavers! He also shares his wartime memories of growing up as a child during the blitz and being sent away from home to live in a boarding school for his own safety, although he ultimately returned home before the war was over. Often, however, the non-chemical memories are offered as background for the rest of the story.

I enjoyed this book very much, even though the extent of my chemistry background consists of getting a "C-" in high-school chemistry. My father, a design engineer who worked for many years in a chemical engineering department at a university, also enjoyed it. Based on these two opinions, at least, I can conclude that the book probably would appeal to a fairly wide geek-audience.

More can be discovered about the author at www.oliversacks.com

You can purchase Uncle Tungsten from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Simon P. Chappell writes "I started learning how to use the Struts framework in late in 2001, after I became fed-up with hacking web applications together with the digital equivalent of "Duct-tape Engineering". At that time there were no books available for the budding Struts developer, "Read The Fine Manual" was not an option ... you read the website, you read the code or you asked questions on the mailing list. This situation finally changed this fall with the release of a flurry of titles dedicated to Struts. I present here my thoughts on one of the latest: "Struts Kick Start". The rest of Simon's review follows. Struts Kick Start author James Turner and Kevin Bedell pages 481 (29 page index) publisher Sams rating 9 reviewer Simon P. Chappell ISBN 0672324725 summary You need this book

What is Struts?

Struts is a framework for developing web applications. It is a distilation of the current set of known best practices into a working code set that can be extended to meet almost any web application requirements. It part of the Jakarta Project at the Apache Software Foundation.

What do I know about Struts? I have been developing web applications, using Java, for four years and using struts for over a year, and am a regular participant on the Struts mailing list. I was also a technical reviewer for one of the other Struts Books released this fall and was recently invited to speak at the University of Wisconsin, Eau Claire on the use of Struts.

What's good about this book? There are many excellent things that I could point to. I particularly like the obvious depth of research that accompanies this book. There is a very interesting history of the development of the MVC design pattern and they even name the inventor. Do you know who invented MVC? If you want to know, buy the book! The chapters cover everything that you will need to know, in the order you are most likely to need to know it. There's even a chapter explaining the "struts-config.xml" file's DTD! (You may want to skip that on the first few readings :-)

There is good coverage of the Struts taglibs. I see a lot of questions about these on the mailing lists, so this information is very timely and it looks very well explained.

I like the coverage of other open source tools that work well with Struts. This is an important point because Struts does not do everything for you (by design), so there will be areas that will benefit from other tools. I'm looking forward to trying out some of their recommendations and easing my own Struts development lifecycles.

What's not so good? Just one niggle, and it's more of a programming style issue, but in their example code they have references to their business objects. They explain that it is important to separate out business logic from action logic, which it is, but then proceed to use their business object within the action.

Now, I realise that example code is not the same thing as robust, production-ready code, but when people are first learning a language or framework, they tend to copy exactly what they see in the book they are learning from. Even though example code should be light on error checking, it should be heavy on correctness and good style.

Should you rush out and buy it? If you are about to use Struts on a project, are new to Struts and need dead tree documentation for those RTFM moments or are evaluating Struts for future projects, then you absolutely need this book.

If you are an intermediate Struts user, then this book would still be very useful to you and I can certainly recommend it.

If you are an experienced Struts user, then you've almost certainly exchanged emails with James or Kevin, on the Struts mailing list, so you can make your own mind up!

Table of Contents

1. Struts in Context
2. The Model-View-Controller Design Pattern
3. Hello World!
4. HTTP Protocol
5. JSP, Taglibs and JSTL
6. The Sample Application
7. View Components
8. The Controller
9. Model Components
10. The struts-config.xml File
11. How the Struts Tag Libraries Work
12. Struts HTML Tags
13. Struts Bean Tags
14. Struts Logic Tags
15. The Nested and Template Struts Tag Libraries
16. The Struts Tiles Tag Library
17. DynaForms and the Validator
18. Using Struts with Enterprise Java Beans
19. Using Struts with Web Services
20. Building, Deploying and Testing Struts Applications

You can purchase Struts Kick Start from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

davorg contributes this review of Wiley's new Red Hat Linux 8 Bible, writing "I've never been much of a fan of large computer books and, to be honest, this one hasn't done much to change my opinion. These large books often seem a little confused about their target audience. They often cover everything from very basic concepts to very complex ones, and I don't really believe that anyone really needs that breadth of coverage. Or, at least, not all at the same time and from the same book." You'll find the rest of Dave's review below. Red Hat Linux 8 Bible author Christopher Negus pages 1062 publisher Wiley rating 6 reviewer davorg ISBN 0764549685 summary Wide but shallow overview of Red Hat Linux 8.0

This book is a great example of that. It comes complete with three CDs containing Red Hat Linux (which, I assume, are the same as or very similar to the three that come with Red Hat's own shrink-wrapped product) and it therefore starts with installing Red Hat Linux. However, some thousand or so pages later, the same book is talking about some really quite advanced systems administration tasks. I'm really not sure that the same audience will need both of those ends of the spectrum.

Let's take a look at the contents in more detail:

Chapter 1 gives a useful review of Red Hat Linux. It pretty much assumes that the reader knows nothing about Linux and goes into some detail about what Linux is and where it comes from. It even takes time out at one point to explain what an operating system is. The book does score a few early points for knowing the difference between "hackers" and "crackers" and using the terms correctly. This chapter ends with a more detailed look at Red Hat Linux and some of the changes that were introduced with version 8.0. Chapter 2 covers the installation of Red Hat Linux. It does a good job of explaining this in a way that would be clear to someone with no previous knowledge of how to do this.

Chapter 3 is the start of the second major section of the book which introduces the day-to-day use of Red Hat Linux. In chapter 3 we look at logging into the system and get an introduction to using Unix from the command line. Chapter 4 goes into a similar level of detail on using the two dominant GUI environments -- Gnome and KDE. For a beginner, it may have made more sense to have these chapters the other way round as most Red Hat installations will boot straight into a GUI environment and one of Red Hat's changes for version 8.0 was to make it far harder to work out how to get a shell window open.

Chapter 5 starts to look at at Linux applications. It begins with a table of common Windows applications and their Linux counterparts. It then goes on to discuss finding, downloading and installing new applications where, to my mind, it would have been more sensible to first look at using some of the pre-installed applications. The chapter also includes details on using the Red Hat Packager Manager (rpm) and running Windows applications using WINE.

Chapters 6 to 9 each look at a separate application area and present a very brief overview of the applications available in that area. Chapter 6 is about producing documents, chapter 7 about games, chapter 8 about multimedia and chapter 9 about the Internet. In all of these chapters the overviews are necessarily very short and it's hard to see how anyone could get much useful work done after reading them. It would be better if the chapters contained references to further reading, but they don't even mention the man pages.

Chapter 10 starts the next section of the book, which is about system administration. It contains a useful overview of a number of the most common administrative tasks like mounting disk drives, monitoring system usage or setting the date and time. Chapter 11 is about administering users. Chapter 12 looks at automating system tasks. It includes an introduction to shell scripting and a useful description of the start-up and shutdown cycle. Chapter 13 covers backing up and restoring files. Chapter 14 is possibly the most useful chapter in the book for the complete Linux beginner as it contains an overview of security issues. This is particularly important with the increase in the number of people who leave their computers permanently attached to their broadband connections.

The forth and final section looks at networking, with chapters on setting up a LAN, a print server, a file server, a mail server and many other shared resources. This section also includes a chapter on getting your network connected to the internet. As with much of the rest of the book, space constraints prevent these chapters from going into great depth, and there are very few references to other material.

So what did I think overall? Well, as I said, it's too big. But on the other hand it's too small. It's too big in that it covers such a wide range of topics that very few people are likely to be interested in all of it. It's too small in that it just doesn't have the space to go into great depth about most of the topics is covers. I think that it would be far more useful if was three books: Red Hat 8 Linux Users Bible, Red Hat 8 Linux Admin Bible and Red Hat 8 Networking Bible. Each of them could be smaller than this volume, but still cover the material in more detail.

Having said that, the material all seems accurate. The few times I noticed something that I thought was wrong, on checking I found that I was mistaken. So if want you really want is a broad (but in places shallow) overview of Red Hat Linux then this could well be the book for you.

And it's also cheaper than the "official" Red Hat Linux products.

You can purchase Red Hat Linux 8 Bible from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Rerekuka writes "Imagine your home town is built on a moonscape, epic in cracked earth, hard sun, dust storms, thunderstorms, rainbow sherbet sunrises and tie-dyed sunsets that move you and your neighbors to applause. Imagine art born from 25,000 of your closest friends, from you, lining the streets and filling the dustbowl playa: a radiant cathedral built from recycled plastic "stained glass," a filigreed temple-mausoleum filled with messages to friends who have passed on, a coffin made of gun metal, a Tesla coil taunted by a wacky scientist, an art and philosophy-lined labyrinth, oases sprouting lawns and ferns." There's been a lot written about Burning Man; I especially like Bruce Sterling's report about it for Wired in 1996. Read on for Rerekuka's review of Holly Kreuter's book about the festival. Drama in the Desert: The Sights and Sounds of Burning Man author Holly Kreuter pages 144 publisher Raised Barn Press rating 9.5 reviewer Nina Rene Soreco ISBN 0-9721789-0-2 summary Multimedia immersion into the Burning Man culture. Imagine the only vehicles in the streets are art cars, like behemoth metal dragons spouting fire and spaghetti western covered wagons. Imagine strangers who would read to you from William Carlos Williams, offer you a snow cone or a Margarita. Imagine folk costumed in everything and nothing imaginable. Imagine walking into any jazz joint or grilled cheese stand, or getting your hair washed or your feet massaged, and your money is no good because this town operates on a gift economy. Imagine that everybody Leaves No Trace. Imagine diversity coexisting with common ritual - ritual based on radical free expression and purification by fire. Imagine a place where creation and impermanence, innocence and experience, the ridiculous and the sublime, are honored as facets of the same jewel. Imagine this is no fantasy.

Drama in the Desert: The Sights and Sounds of Burning Man is a compelling multimedia chronicle of life in Black Rock City, hometown to some 25,000+ "burners" who gather yearly over Labor Day week for the Burning Man festival in Nevada's Black Rock Desert. The book and accompanying DVD contain the stunning photography of Holly Kreuter and the artwork and voices of Burning Man participants, including an introduction by bestselling author Dave Eggers and a foreward by Burning Man founder Larry Harvey. The 74-minute DVD is, in Kreuter's words, "the book on steroids." Produced by Michael Lazar, the DVD showcases 560 of the author's images in a frame as large as your screen, and includes interviews with some of the artists and Larry Harvey. Sean Abreu's mesmeric, tribal soundtrack to the DVD is available separately. The CD drew mystified appreciation from a coworker who meandered into my cube, the DVD is an immersive meditation, and the book, gorgeously designed by Lisa Hoffman, has found its home on this reviewer's coffee table.

"How was it?" she asks, and attempts are made.
- Shannon Coulter, in a poem by the same name

Holly Kreuter's full-color images (283 in the book, 560 in the DVD), spanning five years of Burning Man citizenry, artwork, events, and land- and skyscapes, are captivating, both in the subjects she chooses and her own interpretive style. Some of the photos are stark and disturbing, such as the deteriorating iron, mesh-fleshed skeleton kneeling on the ashen earth, howling at the sky. Some are vibrant and whimsical, like the many-hued, body-painted folk in one mischievous tableau, the Ice Cream Freezing Man truck, the colorful, life-sized "chess" board, the city aglow with lights and electro-luminescent (EL) wire. Then there's the artwork, bewitchingly captured by Kreuter, that just falls into the "astounding" category: the Plastic Chapel, the Faces, the Temple of Tears, the Emerald City, the man made of books. The images of the tornado-esque dust devils, spinning like dervishes off the blazing 100-foot Man, are epic.

The book is sprinkled with diverse forms of word art, from haiku to narrative, written in strokes as broad as the spectrum of art at Burning Man. Overall, the writing is strong and bold; in a few places, it is a bit uneven or could be pared down, but these instances are minor. Writers include luminaries such as Free Will astrologer and author Rob Brezney, poet and author William L. Fox, and Chris Taylor, San Francisco bureau chief for Time Magazine.

All of the stories are intimate and real, describing journey, vulnerability, humor, awe, magic, and epiphany. One woman speaks of her initial shyness about slipping into the hot springs nude. (She gets beyond it.) John Kelly's testosterone-infused "Let Me Be Dangerous" dreams of riding in the back of a pickup truck going 60 on the playa:

. . . "Mind if I catch a ride?" I asked.
"You fall, you die," the driver answered.
"That's fair," I said.

Rob Brezsny speaks of an experience common in Black Rock City: "I have never in my life felt surrounded by such relaxing fertility, by so much luxuriant conviviality. For many days now I have glided without even a taint of fear through a city of 25,000 people. Unknown allies and I have spotted each other from a block away and run to each other like long-lost friends from previous incarnations . . . I have been in love with more than a few women in my life, but this is the first time I've plunged into the throes of spiritual infatuation with a time and place."

Tom Kramer's simple "Together," describes a premise intrinsic to the Burning Man community, a Buddha gift ripe for the world:

That we appear
separate
is the illusion.

At one time
the desert was
a mountain.

And we were children.

Holly Kreuter has been a Burning Man participant since 1995 and a staffer for Burning Man since 1997. She also founded Raised Barn Press, the production and publishing company that lovingly produced Drama in the Desert.

If you are a citizen of Burning Man ensconced in your everyday life, Drama in the Desert is a soulful trip Home. If you haven't been, Kreuter's collection is a playful, evocative dip into a culture as rich and exotic as can be found.

Experience samples of the text and images from the book, the DVD, and the separate CD at www.desertdrama.com, where you can also order the collection. www.raisedbarnpress.com will get you to the publishing company, a story in itself.

. . . in the great fire
my heart is burnished

brushed
and burned clean

in the great fire
I fall in love again
only this time
I am awake
and the azure sky is as transparent as my imagination

-Mark Jan Wlodarkiewicz, My Heart Has Been Burned Clean

You can purchase Drama in the Desert: The Sights and Sounds of Burning Man from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Stella Daily writes "While the man (or woman) in the white coat no longer has the godlike status he once enjoyed, we still regard the doctors of the world as, perhaps, something more than human. We entrust them with our lives and with the lives of family members; we tell them things we would never tell anyone else. And when they fail, we are often severe in our punishments: multimillion-dollar lawsuits, lost licenses, and most of all, the cloud of public disapproval that follows a physician who has made a particularly well-publicized mistake, sometimes for the rest of his life." Stella's review continues below. Complications: A Surgeon's Notes on an Imperfect Science author Atul Gawande pages 269 publisher Metropolitan Books rating 10 reviewer Stella Daily ISBN 0805063196 summary What happens when humans do an inhumanly difficult job.

Complications is a look at the medical profession from the inside -- written by surgical resident Atul Gawande, it is a frank, thought-provoking commentary on what happens when fallible human beings do a job that requires infallibility. In its chapters, he reveals that doctors make mistakes more often than most of us think -- and that while there are bad doctors, the more usual case is the good doctor having a bad day, or the problem for which all the training in the world would not have been enough.

Gawande is refreshingly honest about the limitations of medicine and of how much doctors, despite years of training, do not know. Witness the titles of the three sections of the book: "Fallibility," "Mystery," and "Uncertainty." He shows us myriad facts and stories that seem designed to make us lose confidence in our physicians. The study that showed that a doctor's confidence in her diagnosis was not related to whether the diagnosis was correct. The colleagues who chose to remain silent when a well-known surgeon began to show signs of incompetence, choosing instead to quietly redirect patients to other doctors when possible. The studies that show that autopsies reveal misdiagnoses in between thirty and forty percent of cases. Yet Gawande suggests physicians are doing the best they can: given the complexity of the human body, the short amount of time they often have to make decisions, and a host of diseases, injuries, and conditions that mimic each other, it is a titanic task we ask of them. Often a doctor has little more than her intuition to go on; sometimes that intuition can result in messy complications, but just as often it results in a spectacular save.

Complications tackles other issues as well: How do we reconcile the needs of patients to have experienced hands performing procedures to the needs of physicians who must teach the procedure to residents so that a new generation of doctors will be able to perform it? What does a doctor do with a patient whose symptoms show no discernible cause? How much say should a patient have in his or her medical treatment? As Gawande describes, until quite recently, the answer was "none -- doctor knows best." But whose body is it, anyway? While the reader might find himself, as I did, indignantly reacting with, "Of course I should be able to decide what happens to me!" Gawande raises an important point. Sometimes a patient really is not in the best position to decide, as when a patient in pain demands the treatment that will alleviate her pain now but cause her serious trouble down the road, unable to consider anything but how much it hurts now. The doctor's dilemma of when to step in is one I do not envy, and one Gawande describes poignantly.

While you will pick up Complications for the ideas and questions it raises, it is the stories Gawande tells, and the polished magazine writer's style with which he tells them, that will make you unable to put it down. Whether it's the television anchorwoman who couldn't stop blushing, the star orthopedic surgeon who inexplicably began doing shoddy work that hurt more than it helped, or the beautiful young event planner who was saved from a deadly infection by Gawande's lucky guess, the stories are about fascinating human beings, and Gawande tells them with riveting language.

If Complications has a weakness, it is that the chapters sometimes seem disjointed, without adequate transition between them. In the acknowledgments, the reader learns that the book originated from several essays Gawande wrote for The New Yorker. When the book is considered as a collection of essays rather than a unified whole, the lack of continuity is not a problem, and even without knowing this, it is still a more than worthwhile read.

Complications is about, as its subtitle says, an imperfect science, but not just any imperfect science. Arguably more than any other field, medicine's failures are held under a microscope and second-guessed ad nauseam; we expect our doctors to be perfect, and when they are not, our disapproval can be severe indeed. While Complications may shock you with its admissions of how deep the errors run, in the end it will give you a better understanding of what it is to be a human being doing an inhumanly difficult job.

You can purchase Complications from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

rjnagle writes "I've always been surprised and even disappointed at my friends' lack of curiosity about Linux. Maybe geeks and slashdotters understand why Linux is so appealing, but many people simply don't have time for it. Even the more open-minded people refuse to consider Linux until it runs a lot of commercial applications (does it support Photoshop? Video games? MS Word? Etc)." Robert reviews below Linux in the Workplace, a book intended to surmount this understandable gap in knowledge. Linux in the Workplace: How to use Linux in Your Office author (Group), SSC Publishers of Linux Journal pages 300 pages publisher No Starch Press rating 3 Stars reviewer Robert Nagle ISBN 1886411867 summary A gentle introduction to KDE

Linux has failed to catch on among ordinary users because PC manufacturers have been prevented from offering dual-boot systems. Not only is partitioning and dual booting a little tricky, the OS CD that comes with a new PC is usually just a system restore, making it difficult to configure a dual-boot environment without messing up factory settings and file systems. Learning Linux has become an all-or-nothing proposition; in many cases the new user has to wipe Windows off his system for good or rely on a second machine just to get started.

The irony is that Linux has never been more user friendly, and the latest KDE desktop on my gentoo box is slicker, faster and easier to use than XP. It is becoming easier to be productive on Linux, and while university students have already discovered this, corporate IT departments who support a large number of Windows-only commercial applications tend to view open source solutions as a time burden (these are the same IT departments whose days are consumed with applying Windows patches or verifying license compliance).

The book Linux in the Workplace shows the ordinary user who has never laid eyes on Linux how to perform everyday office tasks. The book assumes that the user has a machine with Linux already installed and successfully configured. This book (which is more of an introduction to the KDE desktop than Linux itself) is easy and fun to read, and has lots of screenshots. Slashdotters might find this book a bit too basic, but it's the kind of book that a technophobe spouse or child or parent might love (and could very well appear under Christmas trees right beside the new Linux PC).

This book devotes a chapter each to talking about Open Office, Gimp, Konqueror, personal information managers, and various KDE office and email applications. Most of them are part of the KDE window manager or installed by default. This book walks a thin line between being too superficial for daily use and dwelling too much on the technical details. There are better books on The GIMP or OpenOffice, for example, but still it is nice to have introductory chapters in a single book. I found a few useful tidbits on controlling file associations, xscanimage, screen capturing and ark archiver. The book is not without a sense of humor. In a useful section on creating a GPG key, the book says "your passphrase should be rude or embarrassing ... using a naughty passphrase will remind you not to type it where others can see."

This book began with the mission to bring a simplified approach to Linux. By definition, it must exclude certain topics, either by design or because an application was not yet mature when the book was being written. The book scrupulously avoids a discussion of server applications like apache (which makes a certain sense), but it would have been nice to have a section on Evolution or mplayer (yes, a media player is an indispensable application for the bored employee) or ssh, cd burning programs, browser plugins, mozilla, crossover, irc or ftp clients.

Surprisingly, the book contains almost nothing about printing or how to install or upgrade applications. Because the book is intended for a newbie user, not a sys admin, it recommends talking to your network administrator about that. Cop out? Perhaps. But even the unskilled non-root user will have to install apps once in a while; the book would have been much better with a section on rpm managers and compiling programs from scratch.

From a sys admin's point of view, I would have liked to see a case study of an office that had actually made the switch. What problems did it encounter? How did the switch change business processes? What applications required the most time and energy for support? How did a Linux-only office manage domain authentication or interoperability? What system management tools made administration easier in a heterogenous environment?

The book raises an epistemological question about the best way to learn a new technology. Will a user who has never really performed tasks as root be able to leverage the freedom and power offered by open source? Will a user truly be comfortable with an operating system without first having experienced the agony of a bad install or frantically scouring the newsgroups for help ? This book presumes that a learner needs to be able to use normal applications before being ready to handle the admin stuff. The problem with that approach is that it depends on IT staff being near and ready to do some hand-holding. But Linux may emerge in the workplace not as a result of IT's enthusiasm but because of ordinary workers' exasperation with uniform proprietary solutions imposed by these IT departments.

In summary: A useful and friendly KDE-centric introduction to Linux for nongeeks. The lack of system administration material makes it probably too basic for slashdotters.



Also recommended:

RUTE Users' Tutorial and Exposition

A Practical Guide to Red Hat Linux 8 by Mark G. Sobell (not yet published)

Robert Nagle is a technical writer, trainer and Linux aficionado in Houston, Texas. You can purchase Linux in the Workplace from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

rjnagle writes "I've always been surprised and even disappointed at my friends' lack of curiosity about Linux. Maybe geeks and slashdotters understand why Linux is so appealing, but many people simply don't have time for it. Even the more open-minded people refuse to consider Linux until it runs a lot of commercial applications (does it support Photoshop? Video games? MS Word? Etc)." Robert reviews below Linux in the Workplace, a book intended to surmount this understandable gap in knowledge. Linux in the Workplace: How to use Linux in Your Office author (Group), SSC Publishers of Linux Journal pages 300 pages publisher No Starch Press rating 3 Stars reviewer Robert Nagle ISBN 1886411867 summary A gentle introduction to KDE

Linux has failed to catch on among ordinary users because PC manufacturers have been prevented from offering dual-boot systems. Not only is partitioning and dual booting a little tricky, the OS CD that comes with a new PC is usually just a system restore, making it difficult to configure a dual-boot environment without messing up factory settings and file systems. Learning Linux has become an all-or-nothing proposition; in many cases the new user has to wipe Windows off his system for good or rely on a second machine just to get started.

The irony is that Linux has never been more user friendly, and the latest KDE desktop on my gentoo box is slicker, faster and easier to use than XP. It is becoming easier to be productive on Linux, and while university students have already discovered this, corporate IT departments who support a large number of Windows-only commercial applications tend to view open source solutions as a time burden (these are the same IT departments whose days are consumed with applying Windows patches or verifying license compliance).

The book Linux in the Workplace shows the ordinary user who has never laid eyes on Linux how to perform everyday office tasks. The book assumes that the user has a machine with Linux already installed and successfully configured. This book (which is more of an introduction to the KDE desktop than Linux itself) is easy and fun to read, and has lots of screenshots. Slashdotters might find this book a bit too basic, but it's the kind of book that a technophobe spouse or child or parent might love (and could very well appear under Christmas trees right beside the new Linux PC).

This book devotes a chapter each to talking about Open Office, Gimp, Konqueror, personal information managers, and various KDE office and email applications. Most of them are part of the KDE window manager or installed by default. This book walks a thin line between being too superficial for daily use and dwelling too much on the technical details. There are better books on The GIMP or OpenOffice, for example, but still it is nice to have introductory chapters in a single book. I found a few useful tidbits on controlling file associations, xscanimage, screen capturing and ark archiver. The book is not without a sense of humor. In a useful section on creating a GPG key, the book says "your passphrase should be rude or embarrassing ... using a naughty passphrase will remind you not to type it where others can see."

This book began with the mission to bring a simplified approach to Linux. By definition, it must exclude certain topics, either by design or because an application was not yet mature when the book was being written. The book scrupulously avoids a discussion of server applications like apache (which makes a certain sense), but it would have been nice to have a section on Evolution or mplayer (yes, a media player is an indispensable application for the bored employee) or ssh, cd burning programs, browser plugins, mozilla, crossover, irc or ftp clients.

Surprisingly, the book contains almost nothing about printing or how to install or upgrade applications. Because the book is intended for a newbie user, not a sys admin, it recommends talking to your network administrator about that. Cop out? Perhaps. But even the unskilled non-root user will have to install apps once in a while; the book would have been much better with a section on rpm managers and compiling programs from scratch.

From a sys admin's point of view, I would have liked to see a case study of an office that had actually made the switch. What problems did it encounter? How did the switch change business processes? What applications required the most time and energy for support? How did a Linux-only office manage domain authentication or interoperability? What system management tools made administration easier in a heterogenous environment?

The book raises an epistemological question about the best way to learn a new technology. Will a user who has never really performed tasks as root be able to leverage the freedom and power offered by open source? Will a user truly be comfortable with an operating system without first having experienced the agony of a bad install or frantically scouring the newsgroups for help ? This book presumes that a learner needs to be able to use normal applications before being ready to handle the admin stuff. The problem with that approach is that it depends on IT staff being near and ready to do some hand-holding. But Linux may emerge in the workplace not as a result of IT's enthusiasm but because of ordinary workers' exasperation with uniform proprietary solutions imposed by these IT departments.

In summary: A useful and friendly KDE-centric introduction to Linux for nongeeks. The lack of system administration material makes it probably too basic for slashdotters.



Also recommended:

RUTE Users' Tutorial and Exposition

A Practical Guide to Red Hat Linux 8 by Mark G. Sobell (not yet published)

Robert Nagle is a technical writer, trainer and Linux aficionado in Houston, Texas. You can purchase Linux in the Workplace from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

rjnagle writes "I've always been surprised and even disappointed at my friends' lack of curiosity about Linux. Maybe geeks and slashdotters understand why Linux is so appealing, but many people simply don't have time for it. Even the more open-minded people refuse to consider Linux until it runs a lot of commercial applications (does it support Photoshop? Video games? MS Word? Etc)." Robert reviews below Linux in the Workplace, a book intended to surmount this understandable gap in knowledge. Linux in the Workplace: How to use Linux in Your Office author (Group), SSC Publishers of Linux Journal pages 300 pages publisher No Starch Press rating 3 Stars reviewer Robert Nagle ISBN 1886411867 summary A gentle introduction to KDE

Linux has failed to catch on among ordinary users because PC manufacturers have been prevented from offering dual-boot systems. Not only is partitioning and dual booting a little tricky, the OS CD that comes with a new PC is usually just a system restore, making it difficult to configure a dual-boot environment without messing up factory settings and file systems. Learning Linux has become an all-or-nothing proposition; in many cases the new user has to wipe Windows off his system for good or rely on a second machine just to get started.

The irony is that Linux has never been more user friendly, and the latest KDE desktop on my gentoo box is slicker, faster and easier to use than XP. It is becoming easier to be productive on Linux, and while university students have already discovered this, corporate IT departments who support a large number of Windows-only commercial applications tend to view open source solutions as a time burden (these are the same IT departments whose days are consumed with applying Windows patches or verifying license compliance).

The book Linux in the Workplace shows the ordinary user who has never laid eyes on Linux how to perform everyday office tasks. The book assumes that the user has a machine with Linux already installed and successfully configured. This book (which is more of an introduction to the KDE desktop than Linux itself) is easy and fun to read, and has lots of screenshots. Slashdotters might find this book a bit too basic, but it's the kind of book that a technophobe spouse or child or parent might love (and could very well appear under Christmas trees right beside the new Linux PC).

This book devotes a chapter each to talking about Open Office, Gimp, Konqueror, personal information managers, and various KDE office and email applications. Most of them are part of the KDE window manager or installed by default. This book walks a thin line between being too superficial for daily use and dwelling too much on the technical details. There are better books on The GIMP or OpenOffice, for example, but still it is nice to have introductory chapters in a single book. I found a few useful tidbits on controlling file associations, xscanimage, screen capturing and ark archiver. The book is not without a sense of humor. In a useful section on creating a GPG key, the book says "your passphrase should be rude or embarrassing ... using a naughty passphrase will remind you not to type it where others can see."

This book began with the mission to bring a simplified approach to Linux. By definition, it must exclude certain topics, either by design or because an application was not yet mature when the book was being written. The book scrupulously avoids a discussion of server applications like apache (which makes a certain sense), but it would have been nice to have a section on Evolution or mplayer (yes, a media player is an indispensable application for the bored employee) or ssh, cd burning programs, browser plugins, mozilla, crossover, irc or ftp clients.

Surprisingly, the book contains almost nothing about printing or how to install or upgrade applications. Because the book is intended for a newbie user, not a sys admin, it recommends talking to your network administrator about that. Cop out? Perhaps. But even the unskilled non-root user will have to install apps once in a while; the book would have been much better with a section on rpm managers and compiling programs from scratch.

From a sys admin's point of view, I would have liked to see a case study of an office that had actually made the switch. What problems did it encounter? How did the switch change business processes? What applications required the most time and energy for support? How did a Linux-only office manage domain authentication or interoperability? What system management tools made administration easier in a heterogenous environment?

The book raises an epistemological question about the best way to learn a new technology. Will a user who has never really performed tasks as root be able to leverage the freedom and power offered by open source? Will a user truly be comfortable with an operating system without first having experienced the agony of a bad install or frantically scouring the newsgroups for help ? This book presumes that a learner needs to be able to use normal applications before being ready to handle the admin stuff. The problem with that approach is that it depends on IT staff being near and ready to do some hand-holding. But Linux may emerge in the workplace not as a result of IT's enthusiasm but because of ordinary workers' exasperation with uniform proprietary solutions imposed by these IT departments.

In summary: A useful and friendly KDE-centric introduction to Linux for nongeeks. The lack of system administration material makes it probably too basic for slashdotters.



Also recommended:

RUTE Users' Tutorial and Exposition

A Practical Guide to Red Hat Linux 8 by Mark G. Sobell (not yet published)

Robert Nagle is a technical writer, trainer and Linux aficionado in Houston, Texas. You can purchase Linux in the Workplace from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Denise M. Clark writes "The existence of extraterrestrials has long been a subject of heated debate between scientists, scholars and stargazers who've spent many an hour studying the night sky and the universe beckoning beyond. Scientific proof of whether distant life forms and existence are legitimate is yet another bone of contention between UFOlogists and skeptics alike, and while it's easy to make jokes about Area 51 or Roswell, there is certainly a basis for those jokes and rumors. Something had to have happened in these places and many others throughout the globe to engender such speculation and argument." Read on for Denise's encapsulation of a book which undertakes to explain what several of those somethings may have been. Be warned: the base assumption of this book seems to be not whether there are aliens, but what they are like; among other things, the author claims that modern man was genetically engineered by aliens. Unidentified Flying Objects: Starcraft author Der Voron pages 139 publisher PublishAmerica rating 10 reviewer Denise M. Clark ISBN 1591297389 summary A good book about UFOs, especially for those who want to start learning UFOlogy.

In his book, Unidentified Flying Objects: Starcraft, Der Voron has offered an extremely well-researched and detailed report of incidents that have occurred all across the globe, from many different eras. Ancient writings may have been the first indication that 'we are not alone,' and Der Voron cites several of these sources as examples. Such statements originate from many different countries and in different continents, from ancient times to contemporary, from Indian tales of events that took place in the wilds of Kipling country to experiences related by a German artillery gunner during World War Two. Reports of 'unidentified contact with objects of undetermined origins' have been filed in government offices from the plains of South America to the fjords of Norway and the steppes of Asia.

Highly annotated and illustrated with fascinating examples of starship models and their possible makeup, armaments and defensive mechanisms (according to some data belonging to U.S. government research on alien starcraft), this ambitious work offers a wealth of documented information on not only Starcraft, otherwise known as 'Flying Saucers,' but the types of extraterrestrials that have flown them. All aliens are not created equal, as their many varied depictions and origins in historical writings attest. The author's use of a plethora of written documentation ably enhances his description of personal civilian and military accounts of those who have had some kind of interaction with these objects.

Also explored in great detail is the intelligence of our sea life, mainly as that intelligence relates to dolphins and the octopi of our deepest oceans, and how they, in turn, can be used in the search for extended knowledge of the universe surrounding our planet. How and why these creatures have gained such highly specialized communication skills and how it is that an octopus can experience an event and not only remember it, but learn from it, is explored, and commented upon as it relates to man's search for a higher intelligence.

While replete with scientific data, terms and information, this work by Der Voron is nevertheless highly readable and extremely illuminating for the common reader with no prior knowledge of extraterrestrial existence, while at the same time it provides hours of reading material and documentation to keep the more knowledgeable busy.

Der Voron's conscientious effort to dig deep for his sources shows in his detailed reports, and his data gathering and willingness to share that information is a challenging endeavor in which he has aptly succeeded. The existence of extraterrestrials is an immensely interesting topic, one that will be explored for years to come, and this work can provide an invaluable asset to any stargazer's bookshelf.

If this review intrigued you, you may want to see this interview with the author of this book in Weekly Universe. You can purchase Unidentified Flying Objects: Starcraft from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

twos writes "I just read the newly released novel Deadly Perversions, by 2002 ComputerWorld Top 100 IT Leader , well known computer columnist for eWeek, and now author Brett Arquette. The book really rocks with a real virus that's spread via hardware/software during 3D Cybersex encounters. Poof! Kills you in 72 hours." Read on for the rest of twos' review. Deadly Perversions author Brett Arquette pages 406 publisher Lighthouse Press, Inc. rating Excellent & Refreshing. Can't wait to read his next book reviewer twos ISBN 1932211004 summary Deadly virus is spread internationally via the use of Cybersex software/hardware.

This wild novel has a great caricature of Howard Stern and his crew. If you love Howard, he's in the book. If you hate him, Arquette kills him off in chapter 15 (and quite violently I may add). Lots of good computer stuff in it for bit-heads. Tons of Cybersex for chick-heads. It's written in a fascinating self-effacing style where there are just as many laughs to break up the tension as there are chills. I highly recommend this read for anyone under 40. Over that, (unless you're somewhat feral) I don't think you'll get it.

I can't think of a way to traditionally walk you through the book and summarize it, because there are simply too many subplots and wacky characters to do a scene-by-scene breakdown, so if that's what you're looking for it's best to read the back cover of the book.

I'd like to concentrate on Arquette's writing style, which is so unique that I feel there are many reasons this book will become a breakout cult classic bestseller.

First, the novel moves at the speed of light, short, quick, entertaining chapters that keeps you flipping pages trying to find a stopping point, but to no avail. I found I had read half of it before even realizing I had spent hours doing so.

Second - it's fun! How many books can you say were really fun to read, especially fiction thrillers that spend half the time describing characters that get violently killed off right after you get to know them. Arquette's book has zero fluff in it. He has traded in the violence for sex (one of the two are a must for any best selling novel), yet he wrote the book in a way where it doesn't take itself too seriously. I found myself laughing my ass off many times, wondering if this was a thriller or a comedy, but Arquette structured the chapters so the laughs come in just where they're needed, cutting some tension, allowing the reader to take a breath before being consumed in the plot, yet again.

Third - Arquette keeps you guessing. Just when you think you have it figured out, another twist pops up, another character is introduced, and another finding from the CDC comes out, which leads you off in another directly. If you've read the first 21 chapters off his website (for free) don't presume to think you've actually read any of the book or could guess the ending. Not possible unless you have a crystal ball running Linux.

Fourth - It's written in a style I've never read before. I can't compare Arquette to any other writer, which in itself is something of an accomplishment. There are so many authors whose work just blends in with others until their styles all seem the same. Arquette's style, however, is smart and blunt. Where other authors imply things, Arquette writes them in black and white. He takes on subject matter that other authors would just assume leave alone, yet does a wonderful job of spinning it so the characters actions seem perfect reasonable to the character himself.

And lastly, there is freshness in the author's soul, and he writes young, as if he's catering to an 18 through 39 demographic. Most best selling author's are over forty and really don't write their books for the 'instant gratification' world the younger generation is experiencing. For example, books such as Stephen King's bloated 900-page Dream Catcher would have been a tight and quick 400 page novel if Arquette had written it.

I also like Arquette's website and the fact that he's determined to let readers download and read roughly a third of each of his books, before you buy. Some authors let you read a few pages, maybe a few chapters, but Arquette believes if you are going to shell out $15 bucks for a book, you should be able to read enough of it to really know it's something you want to purchase. It will be interesting to see how long his editors let him get away with that, but I find it refreshing that he has that mindset.

You can purchase Deadly Perversions from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Berislav Kucan writes with the following review of Real World Linux Security, 2nd edition. If you've already had a break-in, or just want to avoid it in the future, this book has some tips for you. Real World Linux Security, 2nd edition author Bob Toxen pages 848 publisher Prentice Hall PTR rating 10 reviewer Berislav Kucan ISBN 0130464562 summary In the mentioned 800 pages, this book proves to be pure gold, when we are talking about all aspects of Linux security. Well written, filled with lot of interesting tips and facts about securing the Linux environment, the book can be used both for pumping your knowledge and as a reference in your future security related work.

Who's behind this book?

The author of this book, Bob Toxen, is one of the 162 recognized developers of Berkeley UNIX. He has more then 28 years of UNIX and 8 years of Linux experience. Trivia from his resume includes that he was one of the four developers who did the initial port of UNIX to Silicon Graphics hardware, that he was an architect of the client/server system used by NASA's Kennedy Space Center and that he wrote the "The Problem Solver" column for popular UNIX Review magazine. Currently he is a president of Fly-By-Day Consulting, Inc. offering Linux security-consulting services.

The cover

The Real World Linux Security cover features Cerberus, the three headed dog that safeguarded the entrance to Hades. Hades is an underground place from Greek mythology where deceased people ended up. Cerberus was there to stop the demons from Hades to escape into our world, and vice-versa - stopping the living people entering the Hades. Mr. Toxen did a metaphor connecting the three headed demon dog to a system administrator. How come? "This is not unlike the security aspects of system administrator's job and it certainly seems to require three heads to keep ahead of the problem," he notes.

Inside the book

From the introduction credits, you can see that this book will be an interesting read. The author has a lot of expertise in Linux/UNIX areas, which gives the credibility to the book's title "Real World Linux Security." Another big plus is that the book has about 800 pages of valuable information, divided into these four interest areas:

• Securing your system
• Preparing for an intrusion
• Detecting an intrusion
• Recovering from an intrusion

Securing your system is an imperative for any system administrator. There are many ways to stay in touch with the latest security problems, so patching vulnerable services must be done on a regular basis. Patching won't keep you secure if you don't consider every "living" thing that runs on your production server as a possible entrance into your system. The first part of the book covers the initial step in the "security ring." There are "Seven Most Deadly Sins," the author is warning us:

1. Weak and default passwords
   
2. Open Network ports
   
3. Old software versions
   
4. Insecure and badly configured programs
   
5. Insufficient resources and misplaced priorities
   
6. Stale and unnecessary accounts
   
7. Procrastination
   

If you are interested in various aspects and details on securing your system, you'll enjoy the first 400 pages of the book as it deals with:

• quick fixes for common problems (shutting down unnecessary services, using quality passwords, limiting access)
• common subsystem hacking (playing with sendmail, POP and IMAP servers, samba etc)
• usual hacker attacks (rootkits, packet spoofing, man in the middle and other common attacks)
• advanced security issues (apache and web server security techniques, buffer overflows)

After securing your system, what should you do as the next step? Well -- secure it even more, of course. The second part of the book continues with hardening the system, which is a must for preparing on a possibility of an intrusion. Possible intrusion must always be on your mind, as no one is safe when connected to the Internet. Vulnerability scanners deployed by crackers don't see the difference between your home computer system, a test e-commerce server or a big consultancy company server -- if you have a vulnerable service running on it, you'll probably get burned. This part introduces you to the world of protecting user sessions with SSH, Virtual Private Networks, PGP/GPG cryptography usage, firewalls and DMZs and preparing your hardware to meet the security readiness. I should especially note a great coverage on iptables with some helpful rule sets both mentioned in the book and placed on the CD.

This publication also bears in mind the situation of your system being compromised. It is noted that probably 10-20 percent of people reading this book will suffer a system break-in. By proactively monitoring your system and keeping up-to-date with security web sites, you can reduce the risk of someone hacking your system to the minimum. As a quality security book should have in mind, Real World Linux Security also deals with the darkest system administrator's moment -- successful compromise. The author explains the steps of regaining the control of your system, finding and repairing the damage, tracking the attacker, and sending him/her/them to prison.

As a notable addition, the author doesn't stay blindly connected with just Linux security. As a true expert in his field, he walks into some areas that aren't closely connected with Linux, but with security in general. One of the examples is a 20 page chapter dealing with security policies. In this mini suggestion to the decision makers, he guides us through the possible policies - from accounts and e-mail to network topology, problem reporting and even policy policies.

Another good part that came from Mr. Toxen's experience is a part called "Case studies." Several stories contained in this area describe some of the actual cases that can be compared with hacking history jewels like "Masters of Deception: The Gang That Ruled Cyberspace" by Slatalla/Quittner and "Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage." Stories here describe old-school playing cat-and-mouse with Berkeley sysadmins back in late seventies and making virtual-machine trojans to the latest issues with easy DNS information changes and Microsoft's Visual Studio .Net getting shipped with Nimda worm.

The CD-ROM

The accompanying CD-ROM contains the author's own software for instantly locking out attackers and alerting system administrators. There are also exclusive iptables and ipchains firewall rules, as well as a collection of tools for monitoring network health, detecting and reporting suspicious activities, securing backups, simplifying recovery etc.

The CD has two main folders: "book" and "net." The "book" folder contains up to 100 files, mostly written by the author especially for the needs of this book. These files include Cracker Trap software, sample iptables and ipchains scripts and various useful programs for doing different security related activities. The other folder contains about 40 MB of security software that the author used as references in this book. The tools from this section contain: crack, firestarter, sniffit, john the ripper, LIDS, netfilter, ntop, samhain, snort and more. As you can see, Mr. Toxen has really worked hard to make this CD a worthy addition to the book.

The verdict

After reading some of the comments on the first edition of this book and briefly taking a look at the chapters of this second edition, I knew it would be a great read. After reading it, I must say that "Real World Linux Security" is even better -- I can even say terrific. In the mentioned 800 pages, this book proves to be pure gold, when we are talking about all aspects of Linux security. Well written, filled with lot of interesting tips and facts about securing the Linux environment, the book can be used both for pumping your knowledge and as a reference in your future security related work.

The release of a second edition of this book was proven to be a good choice, and I am really looking forward to the possible third edition in the future.

An interview with the author is available here.

You can purchase Real World Linux Security from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Henry Birdwell contributes the following review of Wrox Press's Professional PHP4. Read on for his impressions, and to see if this book is right for your own dynamic web programming tasks. Professional PHP4 author Luis Argerich et al pages 975 publisher Wrox Press rating 9 reviewer Henry Birdwell ISBN 1861006918 summary Comprehensive print resource for working PHP programmers.

PHP is an open source server-side HTML-embedded web scripting language for creating dynamic web pages. Outside of it being browser-independent, PHP offers a simple and universal cross-platform solution for e-commerce, complex web, and database-driven applications. Professional PHP4 will show you exactly how to create state-of-the-art web applications that scale well, utilize databases optimally, and connect to a backend network using a multi-tiered approach.

Almost an year since its release, this book has stood the test of time, and proved to be what it promised -- an up-to-date, advanced book on PHP -- a category in which there are very few worthwhile entries to date.

It provides a solid, fast-paced drill on the rudimentaries of PHP (although the fast-paced installation instructions come in the form of classic compendia -- worth 100 pages) for seasoned programmers, before it plunges head straight into the more advanced areas of the language. Each chapter reads a bit like a tutorial on a particular area of advanced PHP development.

If you are a competent programmer in just about any other language or have grappled with HTML before, then this book will teach you PHP from scratch . It will also introduce you to many of the more advanced areas of PHP programming, and is a treasure trove for information on diverse tasks possible with the language.

Notable topics include:

• Object Oriented Programming
• Sessions and Cookies
• Coding an FTP Client
• Sending and Receiving Email and News
• Networking and TCP/IP
• Non-Web Programming (including GTK)
• PHP and XML
• PHP and MySQL/PostgreSQL/ODBC
• Security
• Multi-tier development
• Optimisation

The code for the examples presented in the book is available for download, from the publisher's web site.

Although this book is reasonably complete, it lacks sufficient depth for experienced PHP developers who want to wade into the depths of specific PHP related tasks. Having said that, the publisher has provided information (of course at a separate cost) on specific areas with their second level PHP titles -- Professional PHP4 XML , Beginning PHP4 Multimedia Programming , Beginning PHP4 Databases and Professional PHP Web Services .

Suffice to say that the book has packed together a lot of diverse information (in 975 pages).

Related Links

• The official PHP web site
• Zend - the PHP scripting engine

You can purchase Professional PHP4 from bn.com. (You may also be interested in the Slashdot review of Professional PHP XML of a few months ago.) Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Henry Birdwell contributes the following review of Wrox Press's Professional PHP4. Read on for his impressions, and to see if this book is right for your own dynamic web programming tasks. Professional PHP4 author Luis Argerich et al pages 975 publisher Wrox Press rating 9 reviewer Henry Birdwell ISBN 1861006918 summary Comprehensive print resource for working PHP programmers.

PHP is an open source server-side HTML-embedded web scripting language for creating dynamic web pages. Outside of it being browser-independent, PHP offers a simple and universal cross-platform solution for e-commerce, complex web, and database-driven applications. Professional PHP4 will show you exactly how to create state-of-the-art web applications that scale well, utilize databases optimally, and connect to a backend network using a multi-tiered approach.

Almost an year since its release, this book has stood the test of time, and proved to be what it promised -- an up-to-date, advanced book on PHP -- a category in which there are very few worthwhile entries to date.

It provides a solid, fast-paced drill on the rudimentaries of PHP (although the fast-paced installation instructions come in the form of classic compendia -- worth 100 pages) for seasoned programmers, before it plunges head straight into the more advanced areas of the language. Each chapter reads a bit like a tutorial on a particular area of advanced PHP development.

If you are a competent programmer in just about any other language or have grappled with HTML before, then this book will teach you PHP from scratch . It will also introduce you to many of the more advanced areas of PHP programming, and is a treasure trove for information on diverse tasks possible with the language.

Notable topics include:

• Object Oriented Programming
• Sessions and Cookies
• Coding an FTP Client
• Sending and Receiving Email and News
• Networking and TCP/IP
• Non-Web Programming (including GTK)
• PHP and XML
• PHP and MySQL/PostgreSQL/ODBC
• Security
• Multi-tier development
• Optimisation

The code for the examples presented in the book is available for download, from the publisher's web site.

Although this book is reasonably complete, it lacks sufficient depth for experienced PHP developers who want to wade into the depths of specific PHP related tasks. Having said that, the publisher has provided information (of course at a separate cost) on specific areas with their second level PHP titles -- Professional PHP4 XML , Beginning PHP4 Multimedia Programming , Beginning PHP4 Databases and Professional PHP Web Services .

Suffice to say that the book has packed together a lot of diverse information (in 975 pages).

Related Links

• The official PHP web site
• Zend - the PHP scripting engine

You can purchase Professional PHP4 from bn.com. (You may also be interested in the Slashdot review of Professional PHP XML of a few months ago.) Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Henry Birdwell contributes the following review of Wrox Press's Professional PHP4. Read on for his impressions, and to see if this book is right for your own dynamic web programming tasks. Professional PHP4 author Luis Argerich et al pages 975 publisher Wrox Press rating 9 reviewer Henry Birdwell ISBN 1861006918 summary Comprehensive print resource for working PHP programmers.

PHP is an open source server-side HTML-embedded web scripting language for creating dynamic web pages. Outside of it being browser-independent, PHP offers a simple and universal cross-platform solution for e-commerce, complex web, and database-driven applications. Professional PHP4 will show you exactly how to create state-of-the-art web applications that scale well, utilize databases optimally, and connect to a backend network using a multi-tiered approach.

Almost an year since its release, this book has stood the test of time, and proved to be what it promised -- an up-to-date, advanced book on PHP -- a category in which there are very few worthwhile entries to date.

It provides a solid, fast-paced drill on the rudimentaries of PHP (although the fast-paced installation instructions come in the form of classic compendia -- worth 100 pages) for seasoned programmers, before it plunges head straight into the more advanced areas of the language. Each chapter reads a bit like a tutorial on a particular area of advanced PHP development.

If you are a competent programmer in just about any other language or have grappled with HTML before, then this book will teach you PHP from scratch . It will also introduce you to many of the more advanced areas of PHP programming, and is a treasure trove for information on diverse tasks possible with the language.

Notable topics include:

• Object Oriented Programming
• Sessions and Cookies
• Coding an FTP Client
• Sending and Receiving Email and News
• Networking and TCP/IP
• Non-Web Programming (including GTK)
• PHP and XML
• PHP and MySQL/PostgreSQL/ODBC
• Security
• Multi-tier development
• Optimisation

The code for the examples presented in the book is available for download, from the publisher's web site.

Although this book is reasonably complete, it lacks sufficient depth for experienced PHP developers who want to wade into the depths of specific PHP related tasks. Having said that, the publisher has provided information (of course at a separate cost) on specific areas with their second level PHP titles -- Professional PHP4 XML , Beginning PHP4 Multimedia Programming , Beginning PHP4 Databases and Professional PHP Web Services .

Suffice to say that the book has packed together a lot of diverse information (in 975 pages).

Related Links

• The official PHP web site
• Zend - the PHP scripting engine

You can purchase Professional PHP4 from bn.com. (You may also be interested in the Slashdot review of Professional PHP XML of a few months ago.) Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Henry Birdwell contributes the following review of Wrox Press's Professional PHP4. Read on for his impressions, and to see if this book is right for your own dynamic web programming tasks. Professional PHP4 author Luis Argerich et al pages 975 publisher Wrox Press rating 9 reviewer Henry Birdwell ISBN 1861006918 summary Comprehensive print resource for working PHP programmers.

PHP is an open source server-side HTML-embedded web scripting language for creating dynamic web pages. Outside of it being browser-independent, PHP offers a simple and universal cross-platform solution for e-commerce, complex web, and database-driven applications. Professional PHP4 will show you exactly how to create state-of-the-art web applications that scale well, utilize databases optimally, and connect to a backend network using a multi-tiered approach.

Almost an year since its release, this book has stood the test of time, and proved to be what it promised -- an up-to-date, advanced book on PHP -- a category in which there are very few worthwhile entries to date.

It provides a solid, fast-paced drill on the rudimentaries of PHP (although the fast-paced installation instructions come in the form of classic compendia -- worth 100 pages) for seasoned programmers, before it plunges head straight into the more advanced areas of the language. Each chapter reads a bit like a tutorial on a particular area of advanced PHP development.

If you are a competent programmer in just about any other language or have grappled with HTML before, then this book will teach you PHP from scratch . It will also introduce you to many of the more advanced areas of PHP programming, and is a treasure trove for information on diverse tasks possible with the language.

Notable topics include:

• Object Oriented Programming
• Sessions and Cookies
• Coding an FTP Client
• Sending and Receiving Email and News
• Networking and TCP/IP
• Non-Web Programming (including GTK)
• PHP and XML
• PHP and MySQL/PostgreSQL/ODBC
• Security
• Multi-tier development
• Optimisation

The code for the examples presented in the book is available for download, from the publisher's web site.

Although this book is reasonably complete, it lacks sufficient depth for experienced PHP developers who want to wade into the depths of specific PHP related tasks. Having said that, the publisher has provided information (of course at a separate cost) on specific areas with their second level PHP titles -- Professional PHP4 XML , Beginning PHP4 Multimedia Programming , Beginning PHP4 Databases and Professional PHP Web Services .

Suffice to say that the book has packed together a lot of diverse information (in 975 pages).

Related Links

• The official PHP web site
• Zend - the PHP scripting engine

You can purchase Professional PHP4 from bn.com. (You may also be interested in the Slashdot review of Professional PHP XML of a few months ago.) Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Henry Birdwell contributes the following review of Wrox Press's Professional PHP4. Read on for his impressions, and to see if this book is right for your own dynamic web programming tasks. Professional PHP4 author Luis Argerich et al pages 975 publisher Wrox Press rating 9 reviewer Henry Birdwell ISBN 1861006918 summary Comprehensive print resource for working PHP programmers.

PHP is an open source server-side HTML-embedded web scripting language for creating dynamic web pages. Outside of it being browser-independent, PHP offers a simple and universal cross-platform solution for e-commerce, complex web, and database-driven applications. Professional PHP4 will show you exactly how to create state-of-the-art web applications that scale well, utilize databases optimally, and connect to a backend network using a multi-tiered approach.

Almost an year since its release, this book has stood the test of time, and proved to be what it promised -- an up-to-date, advanced book on PHP -- a category in which there are very few worthwhile entries to date.

It provides a solid, fast-paced drill on the rudimentaries of PHP (although the fast-paced installation instructions come in the form of classic compendia -- worth 100 pages) for seasoned programmers, before it plunges head straight into the more advanced areas of the language. Each chapter reads a bit like a tutorial on a particular area of advanced PHP development.

If you are a competent programmer in just about any other language or have grappled with HTML before, then this book will teach you PHP from scratch . It will also introduce you to many of the more advanced areas of PHP programming, and is a treasure trove for information on diverse tasks possible with the language.

Notable topics include:

• Object Oriented Programming
• Sessions and Cookies
• Coding an FTP Client
• Sending and Receiving Email and News
• Networking and TCP/IP
• Non-Web Programming (including GTK)
• PHP and XML
• PHP and MySQL/PostgreSQL/ODBC
• Security
• Multi-tier development
• Optimisation

The code for the examples presented in the book is available for download, from the publisher's web site.

Although this book is reasonably complete, it lacks sufficient depth for experienced PHP developers who want to wade into the depths of specific PHP related tasks. Having said that, the publisher has provided information (of course at a separate cost) on specific areas with their second level PHP titles -- Professional PHP4 XML , Beginning PHP4 Multimedia Programming , Beginning PHP4 Databases and Professional PHP Web Services .

Suffice to say that the book has packed together a lot of diverse information (in 975 pages).

Related Links

• The official PHP web site
• Zend - the PHP scripting engine

You can purchase Professional PHP4 from bn.com. (You may also be interested in the Slashdot review of Professional PHP XML of a few months ago.) Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

BShive writes "Software Architecture: Organizational Principles and Patterns covers the VRAPS model and the organizational aspects of Software Architecture. Patterns and Antipatterns are explored that resolve or complicate problems depending on the criteria involved. A Pattern that solves one situation might become an Antipattern in another, as not all situations need the same solutions. This fact is something forgotten too often in software projects. Architects, coders and even managers might benefit from the information contained in this book. Being able to identify and solve problems in a project and its organization is important for any large software project no matter where you are in the development chain." Read on for the rest of Ben's review. Software Architecture: Organizational Principles and Patterns author David M. Dikel, et al pages 250 publisher Prentice Hall PTR rating 7 reviewer Ben Shive ISBN 0130290327 summary Useful approach to organizing software projects, from people to code.

The book opens by explaining what VRAPS (Vision, Rhythm, Anticipation, Partnering, and Simplification) is and what the book can do for the reader. Software Architecture is increasingly important, but the organizational aspect is often overlooked. Architecture and Organization do overlap, but to the executive the Architecture side is hidden, and to the practitioner the Organizational side is hidden. VRAPS attempts to shift the perspectives of the executive and practitioner to provide a more balanced view. An excellent summary of why each of the VRAPS principles are important is provided. A short example scenario follows, briefly illustrating how the model can be used and misused. These concepts are further expanded throughout the book.

The second chapter is essentially a more detailed look at VRAPS and how everything fits together. Criteria, Patterns and Antipatterns are explained, along with a short history of VRAPS. An amusing anecdote mentioned was a manager who divided his program into one hundred modules to show percent complete. Only five modules had more than 100 lines of code. One of the five had over a million lines. There are similar occurrences throughout the book that illustrate various follies in software development and management.

Chapter three deals with maintaining the vision and direction of the project while balancing all the influences. To a manager, the project may look perfectly ordered on paper while features are added and removed. On paper it still looks neat, but to the practitioner it can appear a jumbled mess. The reader also sees the first example of how the situation layouts are handled in the book. A short summary covering the Criteria, Antipatterns, and Patterns is presented. Then each criterion is further examined with its related Antipatterns and Patterns.

Further chapters proceed with introducing various development concepts that complete the VRAPS moniker. How to put the concepts into practice is explored through the same Criteria, Antipattern and Pattern layout. It does an excellent job of illustrating each part of VRAPS. Following at least some of the principles will result in a project that will be successful, instead of becoming one of the book's examples where the team ended up with nothing to show for its work.

The chapter on the Allaire (now part of Macromedia) case study was the most interesting chapter of the whole book. Company and product development is followed, including mistakes made along the way. The final chapter on 'Building and Implementing a Benchmark' was rather unimpressive. It seemed merely tacked onto the end and included no real conclusion to the entire book. However, the rest of the book is a solid piece of work with very useful information.

The anecdotes and examples throughout keep the reading from becoming too dull. Even with a flat finish to the book it contains plenty of valuable information and is worth the admission price, though it could have been better still.

Chapters

1. What You Can't See could Help You
2. The VRAPS Reference Model: How the Pieces Fit Together
3. Projecting and Unifying Vision
4. Rhythm: Assuring Beat, Process, and Movement
5. Anticipation: Predicting, Validating, and Adapting
6. Partnering: Building Cooperative Organizations
7. Simplification: Clarifying and Minimizing
8. Principles at Work: The Allaire Case Study
9. Case Study: Building and Implementing a Benchmark Using VRAPS

Appendixes

A. Quick Reference Table: Principles, Criteria, Antipatterns, and Patterns
B. Antipattern and Pattern Summaries

You can purchase Software Architecture: Organizational Principles and Patterns from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

curtisfrye writes " I've read and enjoyed two of Howard Rheingold's previous books, so I was looking forward to Smart Mobs. The first of the other two books, The Virtual Community, chronicled the early days of The Well (an online service in San Francisco), while Virtual Reality looked at VR technologies. As Howard told me in an interview a few weeks ago (see the link at the end of this review), he was one of the first people writing trade books about how MUDs, ARPAnet, and other online technologies affected society. He also confided in me that part of the reason he started writing about this stuff was so he could justify to his wife all the time he spent online. I, for one, am glad she saw the wisdom of his ways." Read on for Frye's dissection of Rheingold's latest work, Smart Mobs. Smart Mobs author Howard Rheingold pages 288 publisher Perseus Books rating 92% reviewer Curtis Frye ISBN 0738206083 summary As the possibilities for a wireless future unfold, Rheingold argues for an open network we can use to our best advantage.

The central thesis of Smart Mobs is that wireless communication technologies offer a new way for folks to combine their knowledge and energy. As Howard says in the book's introduction:

"If the transition period we are entering in the first decade of the twenty-first century resembles the advent of PCs and the Internet, the new technology regime will turn out to be an entirely new medium, not simply a means of receiving stock quotes or email on the train or surfing the Web while walking down the street. Mobile Internet, when it really arrives, will not be just a way to do old things while moving. It will be a way to do things that couldn't be done before." (p. xiv)

I've done my share of pie in the sky predicting based on what other people have written, so I appreciate it when a writer takes the time to find out what's happening on the ground with regard to the new technologies they're writing about. As it turns out, Howard spent quite a bit of time in Europe, Scandinavia, Japan, and Redmond (with Microsoft's resident online sociologist) finding out how people behave in countries with more advanced wireless communication grids and standards that let people send text messages to any wireless-equipped device (not just to users on the same network as in the US). Those stories, and the personalities driving them, are all chronicled in Smart Mobs.

As engaging as Howard is as a writer, I couldn't give his work such a high rating if I didn't feel his book was something a literate but not necessarily technically sophisticated reader could pick up and, having read it, understand the forces at work. Fortunately, it's all there. I'd imagine that most all of the folks who buy Smart Mobs will know about Moore's Law, which states that the number of computing elements that could be fit in a given space would double every eighteen months. There are other forces at work, though, and Howard lists the three other "laws" that apply to wireless networking in a social context:

• Sarnoff's Law, which states that the value of a broadcast network is proportionate to the number of viewers.
• Metcalfe's Law, which states that the value of a network where each node can reach every other node grows with the square of the number of nodes.
• Reed's Law, which states that, for a network where members of the network can form groups within the network, the value of that network will grow exponentially. That is, the value of the network is equal to the number of nodes raised to the power of the number of nodes, instead of just the square of the number of nodes.

Web logs ("blogs"), eBay, and other online communities are examples of how users have made the Internet a network that conforms to Reed's Law.

So what's not to like about a new wireless Internet where the users are free to roam and create their own groups, spread their information, and share resources? From the point of view of the communication operators (a.k.a. the phone companies), they see little good coming out of creating a medium where they give up their powerful position as information gatekeepers. And, of course, there are vested financial interests on the part of the companies that have leased the rights to different parts of the radio frequency spectrum, even though there are technologies that can avoid interference and make sure all devices can "play nice."

On the political side, wireless technologies have had tremendous impacts, speeding the downfall of a government in the Philippines and being used to coordinate action during the World Trade Organization demonstrations in Seattle. I wouldn't be too surprised if there are plans in place to black out on civilian wireless networks on an emergency basis in case of similar activity in the U.S..

We're taking the first baby steps toward a new wireless network, but there's a lot to be determined, both technologically and in terms of the freedoms we'll enjoy in using the network. Smart Mobs is a wonderful introduction to the issues at hand, and Howard Rheingold makes a powerful argument for an open network we can use to our best advantage.

Curtis D. Frye is the editor and chief reviewer of Technology and Society Book Reviews. He is also the author of three online courses and ten books , including Privacy-Enhanced Business from Quorum Books. You can purchase Smart Mobs from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Peter H. Schmidt writes "As the world increasingly relies upon the Internet and TCP/IP-based networks, their reliability and availability have become pressing topics for both enterprises and service providers. The Internet was designed for resiliency, not the 99.999% uptime of the PSTN, but it is now being required to do both jobs. This book on VRRP -- the Virtual Router Redundancy Protocol -- details the open, RFC-track protocol which has been developed to help ensure that edge router failures can be handled automatically without affecting connectivity." Peter's complete review (below) is interesting even if you never have to deal with the network at this level. VRRP Increasing Reliability and Failover with the Virtual Router Redundancy Protocol author Ayikudy Srikanth, Adnan Adam Onart pages 540 publisher Addison Wesley rating Recommended reviewer Peter H. Schmidt ISBN 0201715007 summary An in-depth review of VRRP that is loaded with helpful and informative details.

Protocols that allow for automatic failover to a backup router have been around for a while, but they are proprietary, including Digital's IP Standby Protocol (IPSTB) and Cisco's more well known Hot Standby Routing Protocol (HSRP). These protocols have been used successfully for years, but as with all proprietary protocols, they lock users into one vendor. Plus, the test of time has shown there are ways in which they can be improved upon. VRRP has been developed in response.

VRRP lets you set up groups of routers to cover for each other, with each group acting like one virtual router with it's own MAC and IP addresses. If the main router in a group should go down, the others will quickly (in under 3-4s, typically) notice and one of them will be elected to take over. VRRP makes it easy to set up multiple routers with multiple WAN connections and make sure that WAN connectivity won't be lost if a router goes down.

As the open alternative to HSRP, you can count on VRRP being widely supported by the router vendors. Even Cisco is shipping it now. If you design, build or install routed networks of any size, VRRP is something you probably need to learn about.

Read This Book!

Let me just say up front that I think this is a very good book, and worth the read. As the title says, it is all about how to increase the reliability and failover capability of your network. VRRP is its subject, but it is treated with a thoroughness and attention to context I have rarely seen in a protocol text. Perhaps that follows from the fact that reliability and availability are only of concern due to economics; few protocols are developed to meet a business need, so most books on them never need to get beyond defining where they fit in their protocol family. Despite the context material, I found it easy to jump to the low-level technical details, yet was somewhat surprised to find myself actively enjoying the extensive introductory material.

Srikanth and Onart have put a wealth of background into the book. The first chapter treats network availability from a theoretical perspective, but does it so clearly and enjoyably that I read it straight through and felt I had learned some valuable new concepts. It also gave me all the context necessary to easily follow their discussion of the need for, conceptual operation of, and benefits from VRRP in Chapter 2.

Part II, comprising Chapters 3-6, presents the protocol, discussing its messages, state machine and issues with different LAN technologies, firewalls, tunnels and VPNs. I found this a useful complement to the RFC. Here is where I found the details I always look for first when confronting a new protocol: how many messages are there, how many states, what kind of implementation trade offs are going to be necessary? I particularly appreciated the abundance of clear, annotated diagrams in this part of the book, though they aren't confined to these chapters alone.

The chapters of Part III concern themselves with managing VRRP, and what is noteworthy here are the numerous examples of how you can configure and manage realistic scenarios. Juniper and Nortel routers are used in the examples, and you are given step by step instructions on using SNMP, the CLIs and a GUI (HP Openview). If I had to set a customer up with a redundant router configuration tomorrow, I would grab these chapters first thing.

Part IV may be the most useful part of the book for the experienced network engineer. Chapter 10 presents an excellent discussion of the pros and cons of VRRP vs HSRP and IPSBP, and includes some nice summary tables. Chapter 11 discusses the future of VRRP, and answered many of the niggling "How would it handle this scenario?" questions which had popped up as I read how the current VRRP works.

The final section of the book is comprised of 200 pages of appendices. They start with a moderately brief but well done overview of TCP/IP and IP networks. That is followed by the complete VRRP MIB. Then we are given Linux source from http://w3.arobas.net/~jetienne/vrrpd/ and a nice commentary on it. Next is a thorough explanation of the SDL (Specification and Description Language) and flowcharts which were used to define the state machine in Part II. And if this isn't enough rigor for you, you'll be pleased that the following appendix using first-order predicate calculus to specify VRRP yet more clearly. (If you don't know what first-order predicate calculus is, just feel lucky and skip that part...) The final appendix covers UML, the Unified Modeling Language, which also is used in Part II to show how VRRP state transitions occur.

What's Not to Like?

There is very little to object to about this book. If it has a fault, it may be that it is a bit too comprehensive. VRRP is actually a fairly simple protocol, and I write that as someone who has designed and implemented protocol stacks for over 8 years. The level of rigor and detail put into VRRP in this book are worthy of something as hairy as OSPF or BGP4. I found myself getting lost in the notational details of their examples at times, they were so exactingly detailed, but I found that if I just looked at the diagram and skipped to the last paragraph, I'd get what I needed. This book would actually make a pretty good reference book on networking in general, there's so much here!

FAQs

What level of experience is needed to make good use of the information in the book?

This book has all the intro material a novice to networking could want, yet has it all so well organized that it is easy for the advanced reader to find the interesting details.

Who will find it most useful? Is there an existing, canonical book that already covers the same ground?

I think this book would be most useful for enterprise network designers, implementers and operations people, no matter what their current skill level. I couldn't find another book on VRRP, so it's good that the only game in town right now is a good book.

Is the book readable as well as technically accurate? Is the language stilted, or natural? Are examples easy to follow?

The book is very readable - unusually so. As for accuracy, I didn't notice anything amiss, and I used to QA stuff like this. Good use of language, and a ton of excellent examples.

Is the depth appropriate?

This book dives deep, but not without plenty of warning and acclimatization first for people not quite ready for the open ocean.

Are the illustrations appropriate and well executed?

Excellent, clear illustrations.

Do any extras come with the book, like a CD-ROM of additional information or code samples?

You get a full printout of the VRRP MIB, as well as commented source code.

What's missing from the book? Would it benefit from illustrations, a better index, a final chapter on practical applications?

Nothing significant.

You can purchase VRRP from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

cybrpnk2 writes with the review below of Michael Crichton's latest book, Prey, which he says is "classic Crichton." Only your thoughts on Crichton can determine whether that's an endorsement or a warning. Read on for the review. Update: 12/07 15:29 GMT by T : The link I originally placed to the movie Them "is some 1996 made-for-TV junk, not the 1950s classic." The link has been updated. Prey author Michael Crichton pages 367 publisher Harper Collins rating Excellent - Among his best reviewer cybrpnk2 ISBN 0066214122 summary The latest sci-fi on nanotechnology from the author of Andromeda Strain and Jurassic Park Michael Crichton has gone full circle and done it again, effectively updating his original sci-fi novel The Andromeda Strain for the 21st century. In his latest book Prey, he has gone from using gigantic T. Rex dinosaurs as the big bad back down to microscopic agents once more. All the classic Crichton trademarks are here -- the race against time, the super-hi tech, the twists in plot and theme. It's his best and in some ways most original novel since Jurassic Park and just as likely to be made into a smash motion picture now that morphing animation is well established. In fact, several scenes in the book almost seem gratuitously tacked on to ultimately make use of some special video effect rather than advance the plot, but that's a minor criticism. Overall this is a great, fun read that's destined to be a SF classic.

In some ways willing suspension of disbelief has to be applied less to the technology depicted and more to the relationships between our protagonists Jake and Julia. They're the typical Silicon Valley couple, all right, but oh how conveniently their relationship advances the plot. He's the between-jobs programming team manager who's specialized in code that models distributed processing and genetic algorithms. She's the cute PR talking head who is lining up funding for the revolutionary Xymos nanobots. He's the cool, loving house-dad that takes care of the cute kids. She's the always-working cold bitch who's having an affair -- isn't she? With the tanned surfing god Xymos exec we hiss at as soon as we meet him? Or is this whole plot line perhaps a little too obvious after being set up by page 18? Maybe Crichton has something a little more twisted in mind for the 350 pages that follow ...

Yep, he sure does, and as fast as helicopters can fly we're at the secretive Xymos desert lab in Nevada where nothing is as it seems. Those swirling little dust devils out there on the parking lot security cameras are considerably more menacing than Taz in a Loony Tunes cartoon, but damned if anybody will give Jack a straight answer about just how ... or especially why. Seems the escaped particles that make up the clouds have been programmed with distributed computing algorithms Jack came up with in his last job -- Xymos wants HIM to tell THEM what's going on. Uh, oh -- Jack used the concept of predator / prey stalking dynamics to keep distributed agents focused on a concrete goal.

Jack's subsequent experiences, experiments, thought processes, and realizations lead the reader into a fascinating exploration of the concept of hive mind. In one sense this is a book about prejudice -- people are the most evolved social mammals on Earth, and as such are always misinterpreting the capabilities, actions and behaviors of a swarm that has neither leaders or followers, only members. As such, Prey is a rare SF book that truly does explore a uniquely alien life form with some very interesting twists. It's also a thought-provoking possible example of Vernor Vinge's technological singularity concept.

It's a good book and it's going to make a great movie. If you just can't wait for the movie, though, no problem. Crichton's three-act structure for Prey follows the well-trod path of a trio of 50s-style sci-fi movie classics: Tremors , Them! , and Invasion of the Body Snatchers . Check 'em out and watch 'em in order after you read Prey for a fun follow-up. To include the tension of Jack and Julia's romantic triangle, watch Casablanca first ... and remember, a kiss is just a kiss, as time goes by.

You can purchase Prey from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.